AZT302.1 - Unmanaged Scripting: Automation Account Hybrid Worker Group#

By utilizing an Automation Account configured with a Hybrid Worker Group, an attacker can execute Azure commands on any Azure VM within that Hybrid Worker Group.

Resource

Automation Account

Actions

Microsoft.Automation/automationAccounts/runbooks/draft/write
Microsoft.Automation/automationAccounts/runbooks/write
Microsoft.Automation/automationAccounts/runbooks/publish/action
Microsoft.Automation/automationAccounts/jobs/write

Examples

Az PowerShellAzure CLIAzure REST APIAzure Portal

New-AzAutomationRunbook

az automation runbook create

PUT https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Automation/automationAccounts/{automationAccountName}/runbooks/{runbookName}?api-version=2019-06-01

runbook

Detections

Detection Details#

It is recommended to turn on verbose logging for Automation Accounts.

Logs#

Data Source	Operation Name	Action	Log Location
Resource	Create an Azure Automation job	Microsoft.Automation/automationAccounts/jobs/write	Azure Activity Log
Resource	Publish an Azure Automation runbook draft	Microsoft.Automation/automationAccounts/runbooks/publish/action	Azure Activity Log
Resource	Write an Azure Automation runbook draft	Microsoft.Automation/automationAccounts/runbooks/draft/write	Azure Activity Log
Resource	Create or Update an Azure Automation Runbook	Microsoft.Automation/automationAccounts/runbooks/write	Azure Activity Log
On Target Resource File (Windows)	File Creation	N/A	C:\Packages\Plugins\Microsoft.Azure.Automation.HybridWorker.HybridWorkerForWindows\0.1.0.18\Status

Queries#

Log Analytics

 |where OperationNameValue=="Microsoft.Automation/automationAccounts/jobs/write" or OperationNameValue=="Microsoft.Automation/automationAccounts/runbooks/publish/action"
 or OperationNameValue=="Microsoft.Automation/automationAccounts/runbooks/draft/write" or OperationNameValue=="Microsoft.Automation/automationAccounts/runbooks/write"

Additional Resources

https://docs.microsoft.com/en-us/azure/automation/automation-runbook-execution