analyzing-azure-activity-logs-for-threats

Name: analyzing-azure-activity-logs-for-threats
Author: killvxk

34stars9forks

How to install analyzing-azure-activity-logs-for-threats?

killvxk/cybersecurity-skills-zh/analyzing-azure-activity-logs-for-threats

$npx -y skills add killvxk/cybersecurity-skills-zh --skill analyzing-azure-activity-logs-for-threats

Installs into the current project.

Summary

通过 azure-monitor-query 查询 Azure Monitor 活动日志和登录日志，检测可疑管理操作、不可能的地理旅行（Impossible Travel）、权限提升和资源修改。为 Azure 环境的威胁狩猎构建 KQL 查询。适用于调查可疑的 Azure 租户活动或构建云 SIEM 检测规则。

Files · 1

View on GitHub

SKILL.md

1	# 分析 Azure 活动日志中的威胁
2
3	## 使用说明
4
5	使用 azure-monitor-query 对 Azure Log Analytics 工作区执行 KQL 查询，检测可疑管理操作和登录异常。
6
7	```python
8	from azure.identity import DefaultAzureCredential
9	from azure.monitor.query import LogsQueryClient
10	from datetime import timedelta
11
12	credential = DefaultAzureCredential()
13	client = LogsQueryClient(credential)
14
15	response = client.query_workspace(
16	workspace_id="WORKSPACE_ID",
17	query="AzureActivity \| where OperationNameValue has 'MICROSOFT.AUTHORIZATION/ROLEASSIGNMENTS/WRITE' \| take 10",
18	timespan=timedelta(hours=24),
19	)
20	```
21
22	关键检测查询：
23	1. 角色分配变更（权限提升）
24	2. 资源组和订阅修改
25	3. 来自新 IP 的密钥保管库访问
26	4. 网络安全组规则变更
27	5. 条件访问策略修改
28
29	## 示例
30
31	```python
32	# 检测新的全局管理员角色分配
33	query = '''
34	AuditLogs
35	\| where OperationName == "Add member to role"
36	\| where TargetResources[0].modifiedProperties[0].newValue has "Global Administrator"
37	'''
38	```

People who liked this also viewed

6 picks

Type

analyzing-azure-activity-logs-for-threats

34stars9forks

View on GitHub

How to install analyzing-azure-activity-logs-for-threats?

killvxk/cybersecurity-skills-zh/analyzing-azure-activity-logs-for-threats

$npx -y skills add killvxk/cybersecurity-skills-zh --skill analyzing-azure-activity-logs-for-threats

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# 分析 Azure 活动日志中的威胁
2
3	## 使用说明
4
5	使用 azure-monitor-query 对 Azure Log Analytics 工作区执行 KQL 查询，检测可疑管理操作和登录异常。
6
7	```python
8	from azure.identity import DefaultAzureCredential
9	from azure.monitor.query import LogsQueryClient
10	from datetime import timedelta
11
12	credential = DefaultAzureCredential()
13	client = LogsQueryClient(credential)
14
15	response = client.query_workspace(
16	workspace_id="WORKSPACE_ID",
17	query="AzureActivity \| where OperationNameValue has 'MICROSOFT.AUTHORIZATION/ROLEASSIGNMENTS/WRITE' \| take 10",
18	timespan=timedelta(hours=24),
19	)
20	```
21
22	关键检测查询：
23	1. 角色分配变更（权限提升）
24	2. 资源组和订阅修改
25	3. 来自新 IP 的密钥保管库访问
26	4. 网络安全组规则变更
27	5. 条件访问策略修改
28
29	## 示例
30
31	```python
32	# 检测新的全局管理员角色分配
33	query = '''
34	AuditLogs
35	\| where OperationName == "Add member to role"
36	\| where TargetResources[0].modifiedProperties[0].newValue has "Global Administrator"
37	'''
38	```

People who liked this also viewed

6 picks

Type