Azure Management Group Modified for Resource Evasion

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•1

This rule detects attempts to modify an Azure Management Group, specifically when a PUT request is made to 'management.azure.com' with 'managementGroups' in the URI. This activity could indicate an attempt to evade defenses by altering management group configurations.