Azure automation persistence
An Azure Automation runbook or webhook was created or modified.
What it detects
An Azure Automation runbook or webhook was created or modified.
Automation is a supported way to run code in a subscription on a schedule or on demand, which makes it an attractive place to hide. A runbook executes under the automation account's managed identity — often a privileged one nobody reviews — and a webhook gives it an unauthenticated HTTPS trigger URL that works from anywhere on the internet with no Entra sign-in and therefore no sign-in log entry. Together they are cloud-native persistence plus a C2 trigger, and both live in the resource plane where identity-focused monitoring never looks.
MITRE ATT&CK mapping
False positives and triage
Automation is a legitimate and widely used service, so in a tenant that already runs runbooks this is routine change activity and must be read against a baseline. The signal is a runbook created in a subscription that has never used Automation, a webhook generated for an existing runbook (that is the trigger being armed, and it is rarer than editing the runbook itself), creation by an account that does not normally touch the resource plane, or activity outside a change window. Read the runbook content and the automation account's role assignments before judging.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 60%. Source: rules/cloud/azure_automation_persistence.yaml, licensed under the Apache License 2.0.
id: cloud.azure.automation_persistence
version: 1.0.0
status: stable
severity: high
confidence: 0.6
platforms: [application]
mitre_techniques: [T1078.004, T1136.003, T1053]
description: |
An Azure Automation runbook or webhook was created or modified.
Automation is a supported way to run code in a subscription on a schedule or on
demand, which makes it an attractive place to hide. A runbook executes under the
automation account's managed identity — often a privileged one nobody reviews —
and a webhook gives it an unauthenticated HTTPS trigger URL that works from
anywhere on the internet with no Entra sign-in and therefore no sign-in log entry.
Together they are cloud-native persistence plus a C2 trigger, and both live in the
resource plane where identity-focused monitoring never looks.
match:
provider: AzureActivity
event_action_contains_any:
- "Microsoft.Automation/automationAccounts/runbooks/write"
- "Microsoft.Automation/automationAccounts/runbooks/draft/write"
- "Microsoft.Automation/automationAccounts/runbooks/publish/action"
- "Microsoft.Automation/automationAccounts/webhooks/write"
- "Microsoft.Automation/automationAccounts/webhooks/action"
- "Microsoft.Automation/automationAccounts/write"
correlation_keys: [user_name]
false_positive_guidance: |
Automation is a legitimate and widely used service, so in a tenant that already
runs runbooks this is routine change activity and must be read against a baseline.
The signal is a runbook created in a subscription that has never used Automation, a
webhook generated for an existing runbook (that is the trigger being armed, and it
is rarer than editing the runbook itself), creation by an account that does not
normally touch the resource plane, or activity outside a change window. Read the
runbook content and the automation account's role assignments before judging.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.