Azure Automation Runbook Created or Modified

Description

Detects when an Azure Automation runbook is created, modified, or published. Runbooks contain executable code that can automate tasks within Azure environments. Adversaries may abuse runbooks for persistence, privilege escalation, or execution of malicious scripts. This rule monitors draft creation, runbook modifications, and publishing activities that could indicate unauthorized automation code deployment.

Query · python

from panther_azureactivity_helpers import (
    azure_activity_alert_context,
    azure_activity_success,
    extract_resource_name_from_id,
)

RUNBOOK_OPERATIONS = [
    "MICROSOFT.AUTOMATION/AUTOMATIONACCOUNTS/RUNBOOKS/DRAFT/WRITE",
    "MICROSOFT.AUTOMATION/AUTOMATIONACCOUNTS/RUNBOOKS/WRITE",
    "MICROSOFT.AUTOMATION/AUTOMATIONACCOUNTS/RUNBOOKS/PUBLISH/ACTION",
]


def rule(event):
    return event.get("operationName", "").upper() in RUNBOOK_OPERATIONS and azure_activity_success(
        event
    )


def title(event):
    resource_id = event.get("resourceId", "<UNKNOWN_RESOURCE_ID>")

    runbook_name = extract_resource_name_from_id(
        resource_id, "runbooks", default="<UNKNOWN_RUNBOOK_NAME>"
    )

    operation = event.get("operationName", "").upper()
    action = "Modified"
    if "PUBLISH" in operation:
        action = "Published"
    elif "DRAFT" in operation:
        action = "Draft Created"

    return f"Azure Automation Runbook {action}: [{runbook_name}]"


def alert_context(event):
    context = azure_activity_alert_context(event)

    resource_id = event.get("resourceId", "")

    runbook_name = extract_resource_name_from_id(resource_id, "runbooks", default="")
    if runbook_name:
        context["runbook_name"] = runbook_name

    automation_account_name = extract_resource_name_from_id(
        resource_id, "automationAccounts", default=""
    )
    if automation_account_name:
        context["automation_account_name"] = automation_account_name

    return context

Analyst notes

  1. Query Azure Monitor Activity logs for all operations by the callerIpAddress in the 24 hours before and after the alert to establish activity patterns
  2. Check if the caller has created or modified automation runbooks in the past 90 days to determine if this is typical behavior
  3. Search for other automation-related activities (webhook creation, automation account creation, runbook job executions) from the same caller in the 6 hours around the alert
Raw source Azure Automation Runbook Created or Modified · Panther Python
Esc
Published by panther-labs/panther-analysis ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
AnalysisType: rule
Filename: azure_automation_runbook_created_or_modified.py
RuleID: "Azure.MonitorActivity.Automation.RunbookCreatedOrModified"
DisplayName: "Azure Automation Runbook Created or Modified"
Enabled: true
LogTypes:
  - Azure.MonitorActivity
Severity: Info
Description: >
  Detects when an Azure Automation runbook is created, modified, or published. Runbooks contain
  executable code that can automate tasks within Azure environments. Adversaries may abuse runbooks
  for persistence, privilege escalation, or execution of malicious scripts. This rule monitors draft
  creation, runbook modifications, and publishing activities that could indicate unauthorized automation
  code deployment.
Reports:
  MITRE ATT&CK:
    - TA0003:T1078.004 # Persistence: Cloud Accounts
    - TA0002:T1059 # Execution: Command and Scripting Interpreter
Tags:
  - AZT302
  - AZT302.1
  - AZT302.2
  - AZT302.3
  - AZT601
  - AZT601.5
  - AZT602
  - AZT605.2
  - Persistence
  - Execution
  -  Cloud Accounts
  - Command and Scripting Interpreter
Runbook: |
  1. Query Azure Monitor Activity logs for all operations by the callerIpAddress in the 24 hours before and after the alert to establish activity patterns
  2. Check if the caller has created or modified automation runbooks in the past 90 days to determine if this is typical behavior
  3. Search for other automation-related activities (webhook creation, automation account creation, runbook job executions) from the same caller in the 6 hours around the alert
Reference: https://github.com/elastic/detection-rules/blob/main/rules/integrations/azure/execution_azure_automation_runbook_created_or_modified.toml
SummaryAttributes:
  - resourceId
  - callerIpAddress
  - correlationId
Tests:
  - Name: Runbook Draft Created
    ExpectedResult: true
    Log:
      {
        "time": "2025-12-22T10:30:00.0000000Z",
        "resourceId": "/subscriptions/12345678-1234-1234-1234-123456789abc/resourceGroups/automation-rg/providers/Microsoft.Automation/automationAccounts/MyAutomationAccount/runbooks/MaliciousRunbook",
        "operationName": "MICROSOFT.AUTOMATION/AUTOMATIONACCOUNTS/RUNBOOKS/DRAFT/WRITE",
        "operationVersion": "2021-06-22",
        "category": "Administrative",
        "resultType": "Success",
        "resultSignature": "200",
        "callerIpAddress": "1.1.1.1",
        "correlationId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
        "level": "Informational",
        "location": "eastus",
        "tenantId": "87654321-4321-4321-4321-111111111111"
      }
  - Name: Runbook Modified
    ExpectedResult: true
    Log:
      {
        "time": "2025-12-22T11:15:00.0000000Z",
        "resourceId": "/subscriptions/11111111-1111-1111-1111-111111111111/resourceGroups/prod-automation/providers/Microsoft.Automation/automationAccounts/ProdAccount/runbooks/UpdateScript",
        "operationName": "MICROSOFT.AUTOMATION/AUTOMATIONACCOUNTS/RUNBOOKS/WRITE",
        "category": "Administrative",
        "resultType": "Succeeded",
        "callerIpAddress": "2.2.2.2",
        "correlationId": "b2c3d4e5-f6a7-8901-bcde-f23456789012",
        "level": "Information",
        "location": "westeurope",
        "tenantId": "22222222-2222-2222-2222-222222222222"
      }
  - Name: Runbook Published
    ExpectedResult: true
    Log:
      {
        "time": "2025-12-22T12:00:00.0000000Z",
        "resourceId": "/subscriptions/33333333-3333-3333-3333-333333333333/resourceGroups/test-rg/providers/Microsoft.Automation/automationAccounts/TestAccount/runbooks/TestRunbook",
        "operationName": "MICROSOFT.AUTOMATION/AUTOMATIONACCOUNTS/RUNBOOKS/PUBLISH/ACTION",
        "category": "Administrative",
        "resultType": "Success",
        "callerIpAddress": "3.3.3.3",
        "correlationId": "c3d4e5f6-a7b8-9012-cdef-333333333333",
        "level": "Informational",
        "location": "centralus",
        "tenantId": "33333333-3333-3333-3333-333333333333"
      }
  - Name: Different Operation
    ExpectedResult: false
    Log:
      {
        "time": "2025-12-22T14:00:00.0000000Z",
        "resourceId": "/subscriptions/55555555-5555-5555-5555-555555555555/resourceGroups/automation-rg/providers/Microsoft.Automation/automationAccounts/MyAccount/runbooks/MyRunbook",
        "operationName": "MICROSOFT.AUTOMATION/AUTOMATIONACCOUNTS/RUNBOOKS/READ",
        "category": "Administrative",
        "resultType": "Success",
        "callerIpAddress": "5.5.5.5",
        "correlationId": "e5f6a7b8-c9d0-1234-ef01-567890123456",
        "tenantId": "55555555-5555-5555-5555-555555555555"
      }

# ------ paired body: azure_automation_runbook_created_or_modified.py ------

from panther_azureactivity_helpers import (
    azure_activity_alert_context,
    azure_activity_success,
    extract_resource_name_from_id,
)

RUNBOOK_OPERATIONS = [
    "MICROSOFT.AUTOMATION/AUTOMATIONACCOUNTS/RUNBOOKS/DRAFT/WRITE",
    "MICROSOFT.AUTOMATION/AUTOMATIONACCOUNTS/RUNBOOKS/WRITE",
    "MICROSOFT.AUTOMATION/AUTOMATIONACCOUNTS/RUNBOOKS/PUBLISH/ACTION",
]


def rule(event):
    return event.get("operationName", "").upper() in RUNBOOK_OPERATIONS and azure_activity_success(
        event
    )


def title(event):
    resource_id = event.get("resourceId", "<UNKNOWN_RESOURCE_ID>")

    runbook_name = extract_resource_name_from_id(
        resource_id, "runbooks", default="<UNKNOWN_RUNBOOK_NAME>"
    )

    operation = event.get("operationName", "").upper()
    action = "Modified"
    if "PUBLISH" in operation:
        action = "Published"
    elif "DRAFT" in operation:
        action = "Draft Created"

    return f"Azure Automation Runbook {action}: [{runbook_name}]"


def alert_context(event):
    context = azure_activity_alert_context(event)

    resource_id = event.get("resourceId", "")

    runbook_name = extract_resource_name_from_id(resource_id, "runbooks", default="")
    if runbook_name:
        context["runbook_name"] = runbook_name

    automation_account_name = extract_resource_name_from_id(
        resource_id, "automationAccounts", default=""
    )
    if automation_account_name:
        context["automation_account_name"] = automation_account_name

    return context

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.