Create Cloud Instance

let AzureInstanceCreate = AzureActivity
| where TimeGenerated > ago(24h)
| where OperationNameValue =~ "MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE"
| where ActivityStatusValue =~ "Succeeded"
| extend CloudProvider = "Azure"
| extend Actor = Caller
| extend SourceIP = CallerIpAddress
| extend InstanceIdentifier = Resource
| extend Scope = ResourceGroup
| extend AccountScope = SubscriptionId
| project TimeGenerated, CloudProvider, Actor, SourceIP, InstanceIdentifier, Scope, AccountScope, Level;
let AWSInstanceCreate = AWSCloudTrail
| where TimeGenerated > ago(24h)
| where EventName =~ "RunInstances"
| where isempty(ErrorCode)
| extend CloudProvider = "AWS"
| extend Actor = tostring(UserIdentityArn)
| extend SourceIP = SourceIpAddress
| extend InstanceIdentifier = tostring(parse_json(ResponseElements).instancesSet.items[0].instanceId)
| extend Scope = AwsRegion
| extend AccountScope = RecipientAccountId
| project TimeGenerated, CloudProvider, Actor, SourceIP, InstanceIdentifier, Scope, AccountScope;
union isfuzzy=true AzureInstanceCreate, AWSInstanceCreate
| sort by TimeGenerated desc

index=* (sourcetype="aws:cloudtrail" OR sourcetype="azure:monitor:activity")
| eval CloudProvider=case(
    sourcetype="aws:cloudtrail", "AWS",
    sourcetype="azure:monitor:activity", "Azure",
    true(), "Unknown"
  )
| eval IsInstanceCreate=case(
    CloudProvider="AWS" AND eventName="RunInstances", 1,
    CloudProvider="Azure" AND match(lower(operationName), "microsoft\.compute/virtualmachines/write"), 1,
    true(), 0
  )
| where IsInstanceCreate=1
| eval Actor=case(
    CloudProvider="AWS", coalesce('userIdentity.arn', 'userIdentity.userName', "unknown"),
    CloudProvider="Azure", coalesce(caller, "unknown"),
    true(), "unknown"
  )
| eval SourceIP=case(
    CloudProvider="AWS", sourceIPAddress,
    CloudProvider="Azure", callerIpAddress,
    true(), "unknown"
  )
| eval SuccessStatus=case(
    CloudProvider="AWS", if(isnull(errorCode) OR errorCode="", "Succeeded", "Failed"),
    CloudProvider="Azure", if(match(lower(status), "succeeded"), "Succeeded", "Other"),
    true(), "Unknown"
  )
| where SuccessStatus="Succeeded"
| eval Scope=case(
    CloudProvider="AWS", awsRegion,
    CloudProvider="Azure", resourceGroup,
    true(), "unknown"
  )
| eval AccountScope=case(
    CloudProvider="AWS", recipientAccountId,
    CloudProvider="Azure", subscriptionId,
    true(), "unknown"
  )
| table _time, CloudProvider, Actor, SourceIP, SuccessStatus, Scope, AccountScope
| sort - _time

any where event.dataset == "azure.activitylogs"
  and event.action : ("Microsoft.Compute/snapshots/write", "Microsoft.Compute/virtualMachines/write",
                      "Microsoft.Compute/virtualMachines/delete", "Microsoft.Compute/disks/write")
  and not user.name : ("azure-backup-service", "azure-site-recovery")

SELECT
  DATEFORMAT(devicetime,'yyyy-MM-dd HH:mm:ss') AS EventTime,
  username, "Operation" AS CloudOperation,
  "ResourceType" AS CloudResource,
  "ResourceGroup", "SubscriptionId",
  CASE
    WHEN "Operation" ILIKE '%delete%' OR "Operation" ILIKE '%destroy%' THEN 90
    WHEN "Operation" ILIKE '%snapshot%' AND "ResultType" = 'Success' THEN 70
    WHEN "Operation" ILIKE '%create%instance%' THEN 60
    ELSE 40
  END AS RiskScore,
  CASE
    WHEN "Operation" ILIKE '%delete%' THEN 'Cloud Resource Deletion'
    WHEN "Operation" ILIKE '%snapshot%' THEN 'Snapshot Operation'
    WHEN "Operation" ILIKE '%create%' THEN 'Cloud Resource Creation'
    ELSE 'Cloud Modification'
  END AS AlertType
FROM events
WHERE LOGSOURCETYPENAME(devicetype) ILIKE '%azure%' OR LOGSOURCETYPENAME(devicetype) ILIKE '%cloudtrail%'
  AND ("Operation" ILIKE '%compute%' OR "Operation" ILIKE '%instance%' OR "Operation" ILIKE '%snapshot%' OR "Operation" ILIKE '%virtualMachine%')
  AND username NOT ILIKE '%azure%automation%'
  AND username NOT ILIKE '%backup%service%'
ORDER BY RiskScore DESC
LAST 1 HOURS

_sourceCategory=*azure*activitylog* OR _sourceCategory=*aws*cloudtrail*
| json auto
| where matches(operationName, "(?i)(snapshot|virtualMachine|instance|compute|create|delete|modify)")
| eval RiskLevel = if(matches(operationName, "(?i)(delete|destroy|terminate)"), "High",
    if(matches(operationName, "(?i)(snapshot|create)"), "Medium", "Low"))
| where RiskLevel in ("High","Medium")
| eval AlertType = if(matches(operationName, "(?i)delete"), "Cloud Resource Deletion",
    if(matches(operationName, "(?i)snapshot"), "Snapshot Operation",
    if(matches(operationName, "(?i)create"), "Resource Creation", "Cloud Modification")))
| where caller != "azure-backup" and !matches(caller, "(?i)automation")
| stats count AS OpCount, values(operationName) AS Operations, values(RiskLevel) AS RiskLevels by _sourceHost, caller, resourceGroup
| sort by OpCount desc

rule T1578_002_cloud_infra_modification {
  meta:
    author = "Detection Engineering"
    description = "Detects suspicious cloud infrastructure modifications"
    severity = "high"
    confidence = "medium"
    mitre_attack = "T1578.002"
    reference = "https://attack.mitre.org/techniques/T1578/002/"

  events:
    $e.metadata.event_type = "USER_RESOURCE_ACCESS"
    re.regex($e.metadata.product_event_type, `(?i)(snapshot|virtualMachine|instance|compute|create|delete|modify)`)
    not re.regex($e.principal.user.email_addresses, `(?i)(backup|automation|serviceaccount)`)

  condition:
    $e
}

#event_simpleName = "CloudResourceModification"
| OperationName = /(?i)(snapshot|virtualMachine|instance|compute|create|delete|modify|revert)/
| ActorUserName != /(?i)(backup|automation|serviceaccount|scheduler)/
| groupBy([aid, ActorUserName, OperationName, ResourceType, ResourceName], function=[count(as=OpCount), min(timestamp, as=FirstSeen)])
| case {
    OperationName = /(?i)(delete|destroy|terminate)/ => RiskScore := "High";
    OperationName = /(?i)(snapshot|create)/ => RiskScore := "Medium";
    * => RiskScore := "Low";
  }
| where RiskScore in ("High", "Medium")
| table([ActorUserName, OperationName, ResourceType, ResourceName, OpCount, RiskScore, FirstSeen])
| sort(RiskScore)