Cloud Administration Command

// Detection 1: Azure RunCommand invocations via AzureActivity
let SuspiciousRunCommandOps = AzureActivity
| where TimeGenerated >= ago(24h)
| where OperationNameValue has_any (
    "MICROSOFT.COMPUTE/VIRTUALMACHINES/RUNCOMMAND/ACTION",
    "Microsoft.Compute/virtualMachines/runCommand/action"
)
| where ActivityStatusValue in ("Success", "Accepted", "Started")
| extend CallerIdentity = Caller
| extend VMName = tostring(split(ResourceId, "/")[8])
| extend ResourceGroupName = ResourceGroup
| extend SourceIP = CallerIpAddress
| project
    TimeGenerated,
    CallerIdentity,
    SourceIP,
    VMName,
    ResourceGroupName,
    SubscriptionId,
    OperationNameValue,
    ActivityStatusValue,
    Properties
;
// Detection 2: Azure Automation Runbook execution
let RunbookOps = AzureActivity
| where TimeGenerated >= ago(24h)
| where OperationNameValue has_any (
    "MICROSOFT.AUTOMATION/AUTOMATIONACCOUNTS/JOBS/WRITE",
    "Microsoft.Automation/automationAccounts/jobs/write",
    "MICROSOFT.AUTOMATION/AUTOMATIONACCOUNTS/RUNBOOKS/DRAFT/TESTJOB/WRITE"
)
| where ActivityStatusValue in ("Success", "Accepted")
| extend CallerIdentity = Caller
| extend AutomationAccount = tostring(split(ResourceId, "/")[8])
| project
    TimeGenerated,
    CallerIdentity,
    SourceIP = CallerIpAddress,
    AutomationAccount,
    ResourceGroup,
    SubscriptionId,
    OperationNameValue,
    ActivityStatusValue
;
SuspiciousRunCommandOps
| union RunbookOps
| order by TimeGenerated desc

// Azure RunCommand via Azure Activity Logs in Splunk
index=* (sourcetype="azure:activity" OR sourcetype="azure:audit" OR sourcetype="mscs:azure:activity")
| eval operation_lower=lower(operationName)
| search operation_lower IN (
    "microsoft.compute/virtualmachines/runcommand/action",
    "microsoft.automation/automationaccounts/jobs/write",
    "microsoft.compute/virtualmachines/extensions/write"
  )
| eval result_status=coalesce(resultType, status)
| search result_status IN ("Success", "Accepted", "Started")
| eval vm_name=mvindex(split(resourceId, "/"), 8)
| eval resource_group=resourceGroup
| eval caller_identity=coalesce(caller, claims.upn, properties.principalOid)
| eval source_ip=callerIpAddress
| eval subscription_id=subscriptionId
| eval event_time=strftime(_time, "%Y-%m-%dT%H:%M:%SZ")
| stats
    count AS invocation_count,
    values(vm_name) AS targeted_vms,
    values(source_ip) AS source_ips,
    earliest(_time) AS first_seen,
    latest(_time) AS last_seen
    BY caller_identity, resource_group, subscription_id, operation_lower
| eval duration_seconds=last_seen - first_seen
| eval multi_vm_targeting=if(mvcount(targeted_vms) > 3, "TRUE", "FALSE")
| table event_time, caller_identity, source_ips, targeted_vms, resource_group, subscription_id, operation_lower, invocation_count, multi_vm_targeting, first_seen, last_seen
| sort - invocation_count

any where event.dataset : "azure.*" and (
  event.action : ("Add*", "Update*", "Delete*", "Consent*") and
  not user.name : "service-*"
) or (
  event.dataset == "azure.signinlogs" and
  event.outcome == "success" and
  source.as.organization.name : ("Tor*", "VPN*")
)

SELECT
    DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS EventTime,
    LOGSOURCENAME(logsourceid) AS LogSource,
    "username" AS AccountName,
    sourceip AS SourceIP,
    "CommandLine" AS CommandLine,
    CASE
        WHEN "CommandLine" ILIKE '%bypass%' THEN 85
        WHEN "CommandLine" ILIKE '%-enc%' THEN 80
        ELSE 60
    END AS RiskScore
FROM events
WHERE
    LOGSOURCETYPENAME(devicetype) IN ('Microsoft Windows Security Event Log', 'Universal DSM')
    AND eventid IN (4688, 1)
    AND RiskScore >= 60
ORDER BY EventTime DESC
LAST 1 HOURS

_sourceCategory=windows/* OR _sourceCategory=endpoint/*
| json auto
| where process_name in ("powershell.exe", "cmd.exe", "wscript.exe", "cscript.exe")
| where process_cmdline matches /(-enc|-bypass|-hidden)/i
| if(process_cmdline matches /-enc/i, 80, 60) as risk_score
| where risk_score >= 60
| count by host, user, process_name, process_cmdline, risk_score
| sort - risk_score

rule detection_t1651 {
  meta:
    author = "Argus Detection Platform"
    description = "Detects Cloud Administration Command - T1651"
    severity = "HIGH"
    mitre_attack = "T1651"
    reference = "https://attack.mitre.org/techniques/T1651/"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    $e.principal.hostname = $hostname
    $e.target.process.file.full_path = $process_path
    $e.target.process.command_line = $cmdline
    re.regex($e.target.process.file.full_path, `(?i)(powershell|cmd|wscript|cscript)\.exe$`) and
    re.regex($e.target.process.command_line, `(?i)(-enc|-bypass|invoke-expression)`)
    not re.regex($e.principal.process.file.full_path, `(?i)(trustedinstaller|msiexec)`)

  condition:
    $e
}

#event_simpleName = "ProcessRollup2"
| ImageFileName = /(?i)(powershell|cmd|wscript|cscript|mshta)\.exe$/
| CommandLine = /(?i)(-enc|-bypass|invoke-expression)/
| case {
    CommandLine = /(?i)-enc/ | DetectionType := "EncodedCommand" ;
    CommandLine = /(?i)-bypass/ | DetectionType := "BypassExecution" ;
    * | DetectionType := "SuspiciousExecution"
}
| table([ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName, DetectionType, ProcessId])
| sort(@timestamp, order=desc, limit=100)