analyzing-azure-activity-logs-for-threats

1# Analyzing Azure Activity Logs for Threats
2 
3 
4## When to Use
5 
6- When investigating security incidents that require analyzing azure activity logs for threats
7- When building detection rules or threat hunting queries for this domain
8- When SOC analysts need structured procedures for this analysis type
9- When validating security monitoring coverage for related attack techniques
10 
11## Prerequisites
12 
13- Familiarity with security operations concepts and tools
14- Access to a test or lab environment for safe execution
15- Python 3.8+ with required dependencies installed
16- Appropriate authorization for any testing activities
17 
18## Instructions
19 
20Use azure-monitor-query to execute KQL queries against Azure Log Analytics workspaces,
21detecting suspicious admin operations and sign-in anomalies.
22 
23```python
24from azure.identity import DefaultAzureCredential
25from azure.monitor.query import LogsQueryClient
26from datetime import timedelta
27 
28credential = DefaultAzureCredential()
29client = LogsQueryClient(credential)
30 
31response = client.query_workspace(
32    workspace_id="WORKSPACE_ID",
33    query="AzureActivity | where OperationNameValue has 'MICROSOFT.AUTHORIZATION/ROLEASSIGNMENTS/WRITE' | take 10",
34    timespan=timedelta(hours=24),
35)
36```
37 
38Key detection queries:
391. Role assignment changes (privilege escalation)
402. Resource group and subscription modifications
413. Key vault secret access from new IPs
424. Network security group rule changes
435. Conditional access policy modifications
44 
45## Examples
46 
47```python
48…