AZT505.1 - Scheduled Jobs - Runbook Schedules#
Adversaries may create a schedule for a Runbook to run at a defined interval.
Resource
Automation Account
Actions
- Microsoft.Automation/automationAccounts/Schedules/write
Examples
Detections
Logs#
Data Source | Operation Name | Action | Log Location |
---|---|---|---|
Resource | Create or Update an Azure Automation schedule asset | Microsoft.Automation/automationAccounts/Schedules/write | Azure Activity Log |
Queries#
|where OperationNameValue=="Microsoft.Automation/automationAccounts/Schedules/write"
Additional Resources
https://docs.microsoft.com/en-us/azure/automation/shared-resources/schedules