Product
medium
advisory
Azure Compute VM Command Execution Detected
2 rules 1 TTPSuccessful execution of commands on Azure Virtual Machines, specifically the MICROSOFT.COMPUTE/VIRTUALMACHINES/RUNCOMMAND/ACTION operation, may indicate unauthorized activity or lateral movement attempts.
Azure Virtual Machines +1
azure
execution
cloud
vm
2r
1t
medium
advisory
Azure Compute Restore Point Collection Deleted by Unusual User
2 rules 1 TTPThe deletion of Azure Restore Point Collections, which contain recovery points for virtual machines, by a user who has not previously performed this activity, indicates a potential attempt to prevent recovery during ransomware attacks or cover tracks during malicious operations.
Azure Compute
cloud
azure
impact
2r
1t