title: Number Of Resource Creation Or Deployment Activities
id: d2d901db-7a75-45a1-bc39-0cbf00812192
status: test
description: Number of VM creations or deployment activities occur in Azure via the azureactivity log.
author: sawwinnnaung
references:
  - https://github.com/Azure/Azure-Sentinel/blob/master/Detections/azureactivity/Creating_Anomalous_Number_Of_Resources_detection.yaml
date: 2020/05/07
modified: 2021/11/27
logsource:
  product: azure
  service: azureactivity
detection:
  keywords:
    - Microsoft.Compute/virtualMachines/write
    - Microsoft.Resources/deployments/write
  condition: keywords
falsepositives:
  - Valid change
level: medium
tags:
  - attack.t1098