AZT601.4 - Steal Managed Identity JsonWebToken: Automation Account Runbook#
If an Automation Account is using a Managed Identity, an adversary can create a Runbook to request the Managed Identity's JWT.
Resource
Automation Account
Actions
- Microsoft.Automation/automationAccounts/runbooks/write
Examples
Detections
Logs#
Data Source | Operation Name | Action | Log Location |
---|---|---|---|
Resource | Create an Azure Automation job | Microsoft.Automation/automationAccounts/jobs/write | Azure Activity Log |
Resource | Publish an Azure Automation runbook draft | Microsoft.Automation/automationAccounts/runbooks/publish/action | Azure Activity Log |
Resource | Write an Azure Automation runbook draft | Microsoft.Automation/automationAccounts/runbooks/draft/write | Azure Activity Log |
Resource | Create or Update an Azure Automation Runbook | Microsoft.Automation/automationAccounts/runbooks/write | Azure Activity Log |
Queries#
|where OperationNameValue=="Microsoft.Automation/automationAccounts/jobs/write" or OperationNameValue=="Microsoft.Automation/automationAccounts/runbooks/publish/action"
or OperationNameValue=="Microsoft.Automation/automationAccounts/runbooks/draft/write" or OperationNameValue=="Microsoft.Automation/automationAccounts/runbooks/write"