AZT504 - Watcher Tasks#
By configurating a watcher task and a Runbook, an adversary can establish persistence by executing the Runbook on a triggered event.
Resource
Automation Account
Actions
- Microsoft.Automation/automationAccounts/runbooks/*
Examples
Detections
Detection Details#
No logs are generated when a watcher task is created.
Logs#
Data Source | Operation Name | Action | Log Provider |
---|---|---|---|
Resource | Create an Azure Automation job | Microsoft.Automation/automationAccounts/jobs/write | AzureActivity |
Resource | Publish an Azure Automation runbook draft | Microsoft.Automation/automationAccounts/runbooks/publish/action | AzureActivity |
Resource | Write an Azure Automation runbook draft | Microsoft.Automation/automationAccounts/runbooks/draft/write | AzureActivity |
Resource | Create or Update an Azure Automation Runbook | Microsoft.Automation/automationAccounts/runbooks/write | AzureActivity |
Queries#
Platform | Query |
---|---|
Log Analytics | AzureActivity | where OperationNameValue == 'MICROSOFT.AUTOMATION/AUTOMATIONACCOUNTS/WATCHERS/WATCHERACTIONS/WRITE' |