title: Number Of Resource Creation Or Deployment Activities
id: d2d901db-7a75-45a1-bc39-0cbf00812192
status: experimental
author: sawwinnnaung
date: 2020/05/07
description: Number of VM creations or deployment activities occur in Azure via the AzureActivity log.
references:
  - https://github.com/Azure/Azure-Sentinel/blob/master/Detections/AzureActivity/Creating_Anomalous_Number_Of_Resources_detection.yaml
logsource:
  service: AzureActivity
detection:
  keywords:
    - Microsoft.Compute/virtualMachines/write
    - Microsoft.Resources/deployments/write
  condition: keywords
level: medium
falsepositives:
  - Valid change
tags:
  - attack.t1098
