Skip to content

AZT302.4 - Unmanaged Scripting: Function Application#

By utilizing a Function Application, an attacker can execute Azure operations on a given resource.

Resource

Automation Account

Actions

  • Microsoft.Web/sites/hostruntime/vfs/run.csx/write
  • Microsoft.Web/sites/functions/write
  • Microsoft.Web/sites/write

Detections

Logs#

Data Source Operation Name Action Log Provider
Resource Write Run.csx Microsoft.Web/sites/hostruntime/vfs/run.csx/write AzureActivity
Resource Update Web Apps Functions Microsoft.Web/sites/functions/write AzureActivity
Resource Update website Microsoft.Web/sites/write AzureActivity