What this tool does
Azure Forensics is a free first-response triage for a suspected Azure compromise. It reads the logs you export from your subscription and answers one question: is there evidence of an attack in the control plane (Azure Resource Manager) or the data plane (Key Vault secrets, storage blobs, network flows)?
Everything happens in your browser: a Rust analyzer compiled to WebAssembly streams your files in a Web Worker. Nothing is uploaded, so you can use it on sensitive production logs.
Supported logs
- Activity Log — every write, delete and action through Azure Resource Manager: role assignments, Run Command, SAS generation, diagnostic settings… Portal CSV, az CLI / REST JSON, Log Analytics AzureActivity (CSV or JSON), or the storage-account / Event Hubs export (insights-activity-logs).
- Key Vault AuditEvent logs — who read which secret, key or certificate, from which IP (insights-logs-auditevent, or AzureDiagnostics in Log Analytics).
- Storage blob logs (StorageRead / StorageWrite / StorageDelete, StorageBlobLogs) — data-plane access, including SAS and anonymous downloads.
- NSG flow logs (v1, v2) and VNet flow logs — network conversations, aggregated per source, destination and port.
- Defender for Cloud alerts (REST / JSON export or Log Analytics SecurityAlert).
How the verdict works
Each detection is a rule in a reviewable JSON file (Sigma-inspired): single events (Run Command, diagnostic setting deleted…), thresholds (bulk blob downloads, secret enumeration) and first-seen rules that learn what is normal during the first 72 hours of your logs (new IP for a service principal, new principal reading a vault, new region).
Compromised: at least two high-severity findings (or one critical). Suspicious: at least one medium or high finding. Clean: nothing above low — which only means nothing matched in the logs you provided.
Findings are mapped to MITRE ATT&CK techniques, tied to the principals, IPs and resources involved, and put on an incident timeline with a remediation checklist.
Detections
The rules shipped with the tool. Rule ids are stable, so you can reference them in your reports.
| Rule | Detects | Severity | MITRE ATT&CK |
|---|---|---|---|
| AZ-RBAC-001 | Privileged role assignedOwner, User Access Administrator or RBAC Administrator was granted: that principal can now give access to anyone. | Medium | T1098.003 |
| AZ-RBAC-002 | Non-human identity assigned a privileged roleA service principal or managed identity granted Owner, Contributor or an access-management role — typical of a stolen app secret. | High | T1098.003 |
| AZ-RBAC-003 | Principal granted a role to itselfThe caller of the role assignment is also the assignee: a classic privilege escalation. | High | T1098.003 |
| AZ-RBAC-004 | Access elevated to all subscriptionsA Global Administrator used elevateAccess to become User Access Administrator at the root scope (/). | High | T1078.004, T1098.003 |
| AZ-VM-001 | Command run on a VM (Run Command)Run Command executes scripts as SYSTEM / root through the VM agent — no network access to the VM needed. | High | T1651 |
| AZ-VM-002 | Custom Script Extension deployedThe extension downloads and runs a script on the VM. | High | T1651 |
| AZ-VM-003 | Serial console connectionInteractive access to the VM that bypasses network controls. | Medium | T1651 |
| AZ-VM-004 | VM created in a region never used beforeA new region compared with the learning period: a common sign of crypto-mining. | Medium | T1496, T1578.002 |
| AZ-VM-005 | Disk or snapshot exportedbeginGetAccess returns a download URL for a whole disk. | High | T1537, T1578.001 |
| AZ-VM-006 | Disk snapshot createdOften a first step before copying a disk out of the subscription. | Low | T1578.001 |
| AZ-KV-001 | Key Vault read by a new principalA principal read secrets, keys or certificates from a vault it never accessed during the learning period. | High | T1555.006 |
| AZ-KV-002 | Key Vault secrets enumeratedOne principal read many different secrets from a vault within an hour. | High | T1555.006 |
| AZ-KV-003 | Key Vault access policy changedAccess policies grant data-plane access to secrets, keys and certificates. | Medium | T1098 |
| AZ-KV-004 | Key Vault protection weakened or objects purgedSoft delete or purge protection disabled, or objects deleted permanently. | High | T1485, T1562 |
| AZ-ST-001 | Storage SAS token generatedAn account / service SAS is a bearer token that works from anywhere until it expires. | High | T1528, T1530 |
| AZ-ST-002 | Storage account keys listedAccount keys give full access to the account's data. | Low | T1552 |
| AZ-ST-003 | Anonymous blob access enabledThe account or a container now serves blobs without authentication. | High | T1530 |
| AZ-ST-004 | Storage firewall openedNetwork rules now accept connections from all networks. | Medium | T1562.007 |
| AZ-ST-005 | Bulk blob downloadMany different blobs were downloaded by one identity from one IP within an hour. | High | T1530, T1567 |
| AZ-ST-006 | Anonymous blob readsBlobs were downloaded without any authentication. | Medium | T1530 |
| AZ-DE-001 | Diagnostic setting deletedA resource (Key Vault, storage, NSG…) stopped sending its logs. | High | T1562.008 |
| AZ-DE-002 | Activity Log export removedThe subscription stopped exporting its Activity Log. | High | T1562.008 |
| AZ-DE-003 | Defender for Cloud plan disabledA Defender plan was set back to the Free tier. | High | T1562.001 |
| AZ-DE-004 | Resource lock removedLocks protect resources from deletion or change. | Medium | T1562 |
| AZ-DE-005 | NSG rule opened to the InternetAn inbound allow rule from any source / Internet was created. | Medium | T1562.007 |
| AZ-PER-001 | Automation runbook or webhook createdRunbooks run code with the Automation account's (often privileged) identity. | Medium | T1648 |
| AZ-PER-002 | Logic App or Function changedServerless code can keep access and run with a managed identity. | Low | T1648 |
| AZ-PER-003 | Federated credential added to a managed identityAn external identity provider can now obtain tokens for this identity. | High | T1098.001 |
| AZ-ID-001 | Service principal used from a new IPAn application identity called Azure from an IP never seen during the learning period. | Medium | T1078.004 |
| AZ-ID-002 | Managed identity token used from a new IPThe identity of a VM or app was used from elsewhere: its token was probably stolen. | High | T1528, T1078.004 |
| AZ-DEF-001 | Defender for Cloud alertMicrosoft Defender for Cloud raised a security alert. | Medium | |
| AZ-NET-001 | Management port reachable from the InternetInbound SSH / RDP / WinRM flows from public IPs were allowed. | Medium | T1133, T1021 |
| AZ-NET-002 | Connection to a crypto-mining portA VM connected out to a port typical of mining pools. | High | T1496 |
| AZ-NET-003 | Large outbound transferMore than 500 MB left the network to a single public IP. | Medium | T1048 |
| AZ-NET-004 | Network traffic with an attacker IPFlow logs show traffic with an IP address involved in other findings. | High | T1105 |
Entra ID (Azure AD) is a separate investigation
This tool covers the Azure control and data planes. How the attacker got the credentials — sign-ins, MFA, new app secrets, consent grants — lives in Entra ID logs, analysed by the sibling tool: M365 / Entra ID forensics
Limitations
- Only what was logged can be found: Key Vault and storage data-plane logs must have been enabled before the incident, and the Activity Log keeps 90 days.
- First-seen detections need more than 72 hours of history before the suspicious activity.
- Rules are heuristics: legitimate automation can match them, and a careful attacker can stay below thresholds. A clean verdict is not an assurance.
- Avro (Event Hubs Capture) and Parquet exports are not read yet; export JSON or CSV instead.
FAQ
Are my logs uploaded anywhere?
No. The analyzer is Rust compiled to WebAssembly and runs in a Web Worker in your browser. There is no upload endpoint; you can even disconnect from the network after the page has loaded.
Which logs should I start with?
The Activity Log of every subscription involved, covering the suspected period plus at least a week before it. Add Key Vault and storage logs if they were enabled, and flow logs for the affected VNets.
How do I know if a Run Command was malicious?
The Activity Log records who ran it, when and from which IP, but not always the script. Correlate with the VM's own logs (the RunCommand extension folder on the VM), Defender alerts and outbound flows from the VM right after.
Does it detect crypto-mining?
It flags VMs created in regions not used before, outbound connections to common mining-pool ports in flow logs, and Defender alerts. Check your billing too: mining usually shows as a sudden compute cost spike.
What does a Compromised verdict mean I should do?
Contain first: rotate the credentials of the principals involved, remove the role assignments they created, isolate affected VMs, rotate secrets that were read. Preserve the logs before they age out. Then investigate the initial access in Entra ID.
Can I reuse the detection rules?
Yes. They live in a plain JSON file with stable ids, MITRE ATT&CK tags and remediation keys, so they can be reviewed, extended and reused in other tools.
Is this affiliated with Microsoft?
No. It is an independent tool; Azure is only named to describe which logs it reads.