Azure Virtual Machine or Resource Deployment Activity
This rule detects the creation of virtual machines or the deployment of resources within an Azure environment. Monitoring these activities can help identify unauthorized resource provisioning, which could indicate an attacker establishing persistence, escalating privileges, or preparing for further malicious actions. The rule specifically looks for 'write' operations related to virtual machines and resource deployments in Azure activity logs.
Sigma
