Azure marketplace image deployed
Third-party marketplace terms were accepted, or a marketplace image was programmatically enabled for deployment.
What it detects
Third-party marketplace terms were accepted, or a marketplace image was programmatically enabled for deployment.
Deploying a VM is ordinary; deploying one from a niche third-party marketplace offer is not, and the distinguishing event is the terms acceptance that has to happen first. It is a once-per-offer action, so it is rare in a way VM creation never is, and it names the publisher — which is the fact an analyst actually wants, because the abuse here is a pre-built image that comes with the miner, the scanner or the proxy already installed.
Deliberately medium: a legitimate first use of a marketplace product looks identical, and only the publisher and the timing separate them. It earns its place as corroboration — accepted terms and a new VM shortly after a suspicious sign-in is a different story from either alone.
MITRE ATT&CK mapping
False positives and triage
Every organisation that buys anything from the Azure Marketplace generates this, and in a team that evaluates tooling it will be routine — the event is not the finding, the publisher is. Compare the publisher and offer named in the record against what the business actually uses; a well-known vendor being onboarded is procurement, an unfamiliar publisher accepted at night by an account with no infrastructure history is not. Look at what was deployed immediately afterwards and its size: crypto-mining shows up as an unusually large or GPU SKU in a region the organisation does not otherwise use. If nothing else corroborates, close it — this rule is not meant to stand alone.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 50%. Source: rules/cloud/azure_marketplace_image_deployed.yaml, licensed under the Apache License 2.0.
id: cloud.azure.marketplace_image_deployed
version: 1.0.0
status: stable
severity: medium
confidence: 0.5
platforms: [application]
mitre_techniques: [T1496, T1578.002]
description: |
Third-party marketplace terms were accepted, or a marketplace image was
programmatically enabled for deployment.
Deploying a VM is ordinary; deploying one from a niche third-party marketplace
offer is not, and the distinguishing event is the terms acceptance that has to
happen first. It is a once-per-offer action, so it is rare in a way VM creation
never is, and it names the publisher — which is the fact an analyst actually
wants, because the abuse here is a pre-built image that comes with the miner, the
scanner or the proxy already installed.
Deliberately medium: a legitimate first use of a marketplace product looks
identical, and only the publisher and the timing separate them. It earns its
place as corroboration — accepted terms and a new VM shortly after a suspicious
sign-in is a different story from either alone.
match:
provider: AzureActivity
event_action_contains_any:
- "Microsoft.MarketplaceOrdering/agreements/offers/plans/sign/action"
- "Microsoft.MarketplaceOrdering/offertypes/publishers/offers/plans/agreements/write"
correlation_keys: [user_name]
false_positive_guidance: |
Every organisation that buys anything from the Azure Marketplace generates this,
and in a team that evaluates tooling it will be routine — the event is not the
finding, the publisher is. Compare the publisher and offer named in the record
against what the business actually uses; a well-known vendor being onboarded is
procurement, an unfamiliar publisher accepted at night by an account with no
infrastructure history is not. Look at what was deployed immediately afterwards
and its size: crypto-mining shows up as an unusually large or GPU SKU in a
region the organisation does not otherwise use. If nothing else corroborates,
close it — this rule is not meant to stand alone.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.