Skip to content

AZT505.1 - Scheduled Jobs - Runbook Schedules#

Adversaries may create a schedule for a Runbook to run at a defined interval.

Resource

Automation Account

Actions

  • Microsoft.Automation/automationAccounts/Schedules/write

Detections

Logs#

Data Source Operation Name Action Log Location
Resource Create or Update an Azure Automation schedule asset Microsoft.Automation/automationAccounts/Schedules/write Azure Activity Log

Queries#

        |where OperationNameValue=="Microsoft.Automation/automationAccounts/Schedules/write"