• CommunityEnterprisePlans
  • Intel Exchange
    Intel ExchangeDetections
  • Resources
  • About
  • Leaderboard
Join CommunitySign In
    All Detections

    Anomalous Resource Creation and related Network Activity

    GlassDiceBearhttps://www.dicebear.comhttps://creativecommons.org/publicdomain/zero/1.0/„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
    Azure Sentinel@AzureSentinel
    •updated Jun 17, 2025•1•0•77

    'Indicates when an anomalous number of resources are created in Azure via AzureActivity log. Resource creation could indicate malicious or spurious use of your Azure Resource allocation.'

    Microsoft Sentinel (KQL)

    Tags

    T1496 - Resource HijackingTA0040 - ImpactTA0011 - Command and ControlTA0010 - ExfiltrationT1564.009 - Resource ForkingTA0042 - Resource DevelopmentT1654 - Log EnumerationDS0015 - Application LogTA0005 - Defense EvasionTA0007 - DiscoveryT1584.008 - Network DevicesT1666 - Modify Cloud Resource HierarchyData ExfiltrationCloud Instance CreatedNetwork ConnectionAdmin ActivityAzureAzure Activity LogsAzure Monitor Logskqltactic:Impacttechnique:T1496

    Community Inspired.
    AI Enhanced.
    Better Detections.

    Follow Us

    Company

    • About
    • Leaderboard

    Product

    • Community
    • Enterprise
    • Plans

    © 2026 Copyright. All Rights Reserved.

    Privacy PolicyTerms of Service

    Sign up to view this detection

    or

    Already have an account?