Runbook - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/runbook/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 25 Jan 2024 12:00:00 +0000Azure Automation Runbook Created or Modifiedhttps://feed.craftedsignal.io/briefs/2024-01-azure-automation-runbook-modification/Thu, 25 Jan 2024 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-azure-automation-runbook-modification/An adversary may create or modify an Azure Automation runbook to execute malicious code and maintain persistence in their target's environment, detected through Azure activity logs.This detection identifies the creation or modification of Azure Automation runbooks, a technique that adversaries can use to execute malicious code within an Azure environment and establish persistence. Azure Automation runbooks are scripts that automate tasks in cloud environments. The activity is detected by monitoring Azure activity logs for specific operations related to runbook creation or modification. While legitimate updates and maintenance may trigger this detection, unauthorized changes to runbooks can introduce backdoors or malicious functionality. The detection focuses on "MICROSOFT.AUTOMATION/AUTOMATIONACCOUNTS/RUNBOOKS/DRAFT/WRITE", "MICROSOFT.AUTOMATION/AUTOMATIONACCOUNTS/RUNBOOKS/WRITE", or "MICROSOFT.AUTOMATION/AUTOMATIONACCOUNTS/RUNBOOKS/PUBLISH/ACTION" operations. This activity is a part of exploiting cloud resources for unauthorized purposes.

Attack Chain

  1. Adversary gains initial access to an Azure account with sufficient privileges to manage Automation Accounts.
  2. The adversary navigates to the Azure Automation service.
  3. The adversary creates a new runbook or modifies an existing one.
  4. The runbook is populated with malicious code, such as PowerShell scripts designed to create a backdoor or exfiltrate data.
  5. The adversary publishes the runbook, making it active within the Azure environment.
  6. The runbook is scheduled to execute automatically or triggered manually.
  7. The malicious code within the runbook executes, performing unauthorized actions such as data exfiltration or resource manipulation.
  8. The adversary maintains persistence by ensuring the runbook continues to execute on a schedule.

Impact

A successful attack can lead to unauthorized access to sensitive data, resource hijacking, and persistent backdoors within the Azure environment. The impact ranges from data breaches and service disruption to long-term control of the compromised Azure resources. Even though rated low severity, successful exploitation leads to further malicious actions within the cloud environment, potentially impacting multiple services and data stores.

Recommendation

  • Deploy the Sigma rule Azure Automation Runbook Creation or Modification to your SIEM and tune for your environment to detect suspicious activity (rule).
  • Review Azure activity logs for the MICROSOFT.AUTOMATION/AUTOMATIONACCOUNTS/RUNBOOKS/DRAFT/WRITE, MICROSOFT.AUTOMATION/AUTOMATIONACCOUNTS/RUNBOOKS/WRITE, and MICROSOFT.AUTOMATION/AUTOMATIONACCOUNTS/RUNBOOKS/PUBLISH/ACTION operations to identify potential unauthorized changes (logs).
  • Implement strict access controls and multi-factor authentication for Azure accounts with permissions to manage Automation Accounts (best practice).
  • Regularly audit and review the content of Azure Automation runbooks to identify any unauthorized or suspicious code (best practice).
  • Consider enabling logging of runbook execution to gain deeper visibility into their activity (best practice).
]]>lowadvisoryazureautomationrunbookexecutionpersistenceAzure Runbook Webhook Creation Detectedhttps://feed.craftedsignal.io/briefs/2024-01-03-azure-runbook-webhook-created/Wed, 03 Jan 2024 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-03-azure-runbook-webhook-created/Detection of a new Azure Automation Runbook Webhook creation, potentially leading to unauthorized access and control over Azure resources by enabling unauthenticated URL triggers.This alert focuses on the creation of new Azure Automation Runbook Webhooks within an Azure tenant. Attackers can exploit these webhooks, which trigger Automation Runbooks through unauthenticated URLs, to execute malicious code, create unauthorized user accounts, or establish persistence within the Azure environment. This activity is detected using Azure Audit events, specifically monitoring for the "Microsoft.Automation/automationAccounts/webhooks/write" operation. This is especially critical as successful exploitation can lead to full control over the Azure resources. Defenders should prioritize monitoring for unexpected or unauthorized webhook creation activities. This detection originated from Splunk's ES-CU detections as of April 2026.

Attack Chain

  1. The attacker gains initial access to an Azure account, possibly through compromised credentials or exploiting a vulnerability.
  2. The attacker navigates to the Azure Automation service within the Azure portal.
  3. The attacker attempts to create a new Automation Account if one doesn't exist, or uses an existing one.
  4. The attacker creates a new Runbook designed to execute malicious tasks. This could include adding a new user account with elevated privileges.
  5. The attacker creates a webhook associated with the malicious Runbook. This generates an unauthenticated URL.
  6. The attacker configures the webhook to trigger the Runbook upon accessing the unauthenticated URL.
  7. The attacker tests the webhook URL to ensure the Runbook executes as intended.
  8. The attacker leverages the webhook URL to execute malicious actions within the Azure environment, such as creating new high privileged accounts or modifying existing infrastructure.

Impact

Successful exploitation allows attackers to gain unauthorized access and control over Azure resources. This can result in data breaches, service disruptions, and further compromise of the environment. If not detected promptly, this can lead to significant financial and reputational damage. This issue impacts any organization using Azure Automation and exposes all data and resources managed within the impacted Azure tenant.

Recommendation

  • Deploy the Sigma rule Azure Runbook Webhook Created to your SIEM and tune for your environment to detect the creation of malicious webhooks.
  • Investigate any detected instances of Azure Runbook Webhook creation, focusing on the user (user) and source IP (src_ip) involved.
  • Review Azure Activity logs for the "Microsoft.Automation/automationAccounts/webhooks/write" operation.
  • Monitor network traffic for suspicious connections to newly created webhook URLs (related to the created object).
  • Implement strict access control policies and multi-factor authentication for all Azure accounts to prevent initial compromise.
]]>highadvisoryazurerunbookwebhookpersistence