Azure Log Analytics

Reported Context (5)

Following are some detection/hunting queries related to anomalous activity associated with Entra ID OAuth applications, using Entra ID (AAD) Audit Logs in Azure Log analytics. Wiz Analyzes Midnight Blizzard’s Microsoft Breach and Suspected OAuth Attack Chain
linked to persistence has occurred using CSP-native interactive query services (AWS Athena, Azure Log Analytics, GCP Logs Explorer). Teams should hunt for signs of persistence regardless of secret rotation. Wiz Shares Cloud Persistence-Hunting Guidance Following CircleCI Breach
OMI (Open Management Infrastructure), used by multiple popular Azure services (Azure Automation, Azure Log analytics Azure Sentinel and more), vendors release patches and customers are required to manually install Azure Adds Opt-In Automatic Updates for Three Agents That Include OMI
and silently installed on users' virtual machines by Microsoft when they set up these services (Azure Log Analytics, Azure Automation and more). These vulnerabilities enabled remote code execution and local Wiz Calls for a Standardized Cloud Vulnerability Database, Later Launches Open CVDB
Many different services in Azure are affected, including Azure Log Analytics, Azure Diagnostics and Azure Security Center, as Microsoft uses OMI extensively behind the scenes as a common component for many of its OMIGOD: Four OMI Flaws Expose Azure Linux VMs to Root Compromise

CVE (5)

People (2)

Threat Actors (5)

MITRE ATT&CK (15)

Vendors (7)

Products (20)

Tools (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.