Query: alert when Identifies when secrets are modified or deleted in Azure.
Matching passage: Sigma rule: Identifies when secrets are modified or deleted in Azure.. Logsource: azure / activitylogs. Rule: title: Azure Keyvault Secrets Modified or Deleted id: b831353c-1971-477b-abb6-2828edc3bca1 status: test description: Identifies when secrets are modified or deleted in Azure. references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations author: Austin Songer @austinsonger date: 2021-08-16 modified: 2022-08-23 tags: - attack.impact - attack.credential-access - attack.t1552 - attack.t1552.001 logsource: product: azure service: activitylogs detection: selection: operationName: - MICROSOFT.KEYVAULT/VAULTS/SECRETS/WRITE - MICROSOFT.KEYVAULT/VAULTS/SECRETS/DELETE - MICROSOFT.KEYVAULT/VAULTS/SECRETS/BACKUP/ACTION - MICROSOFT.KEYVAULT/VAULTS/SECRETS/PURGE/ACTION - MICROSOFT.KEYVAULT/VAULTS/SECRETS/UPDATE/ACTION - MICROSOFT.KEYVAULT/VAULTS/SECRETS/RECOVER/ACTION - MICROSOFT.KEYVAULT/VAULTS/SECRETS/RESTORE/ACTION - MICROSOFT.KEYVAULT/VAULTS/SECRETS/SETSECRET/ACTION condition: selection falsepositives: - Secrets being modified or deleted may be performed by a system administrator. - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Secrets modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Near-miss passage: Sigma rule: Detects Schtask creations that point to a suspicious folder or an environment variable often used by malware. Logsource: windows / process_creation. Rule: title: Schedule Task Creation From Env Variable Or Potentially Suspicious Path Via Schtasks.EXE id: 81325ce1-be01-4250-944f-b4789644556f related: - id: 43f487f0-755f-4c2a-bce7-d6d2eec2fcf8 type: derived status: test description: Detects Schtask creations that point to a suspicious folder or an environment variable often used by malware references: - https://www.welivesecurity.com/2022/01/18/donot-go-do-not-respawn/ - https://www.joesandbox.com/analysis/514608/0/html#324415FF7D8324231381BAD48A052F85DF04 - https://blog.talosintelligence.com/gophish-powerrat-dcrat/ author: Florian Roth (Nextron Systems) date: 2022-02-21 modified: 2025-10-07 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.t1053.005 logsource: product: windows category: process_creation detection: selection_1_create: Image|endswith: \schtasks.exe CommandLine|contains|windash: ' /create ' selection_1_all_folders: CommandLine|contains: - :\Perflogs - :\Users\All Users\ - :\Users\Default\ - :\Users\Public - :\Windows\Temp - \AppData\Local\ - \AppData\Roaming\ - '%AppData%' - '%Public%' selection_2_parent: ParentCommandLine|endswith: \svchost.exe -k netsvcs -p -s Schedule selection_2_some_folders: CommandLine|contains: - :\Perflogs - :\Windows\Temp - \Users\Public - '%Public%' filter_optional_other: - ParentCommandLine|contains: unattended.ini - CommandLine|contains: update_task.xml filter_optional_team_viewer: CommandLine|contains: /Create /TN TVInstallRestore /TR filter_optional_avira_install: CommandLine|contains|all: - '/Create /Xml ' - \Temp\.CR. - \Avira_Security_Installation.xml filter_optional_avira_other: CommandLine|contains|all: - /Create /F /TN - '/Xml ' - \Temp\ - Avira_ CommandLine|contains: - .tmp\UpdateFallbackTask.xml - .tmp\WatchdogServiceControlManagerTimeout.xml - .tmp\SystrayAutostart.xml - .tmp\MaintenanceTask.xml filter_optional_klite_codec: CommandLine|contains|all: - \Temp\ - '/Create /TN "klcp_update" /XML ' - \klcp_update_task.xml condition: ( all of selection_1_* or all of selection_2_* ) and not 1 of filter_optional_* falsepositives: - Benign scheduled tasks creations or executions that happen often during software installations - Software that uses the AppData folder and scheduled tasks to update the software in the AppData folders level: medium