Azure Activity & Defender Logs, GCP Audit Logs

AWS dominates but Azure and GCP are major detection surfaces — especially in organizations with Microsoft 365 (which drives Azure/Entra adoption) and GCP for data engineering workloads. This lesson covers the unique characteristics of each.

Azure: Two Separate Telemetry Streams

Stream 1: Azure Activity Log

The Activity Log records control-plane operations on Azure resources. These are the API calls that change your infrastructure:

{
  "time": "2024-03-15T09:23:14.882Z",
  "operationName": {
    "value": "Microsoft.Authorization/roleAssignments/write",
    "localizedValue": "Create role assignment"
  },
  "status": {
    "value": "Succeeded"
  },
  "caller": "attacker@victim.onmicrosoft.com",
  "subscriptionId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
  "resourceId": "/subscriptions/.../resourceGroups/prod/providers/Microsoft.Compute/virtualMachines/web-01",
  "properties": {
    "requestbody": "{\"properties\":{\"roleDefinitionId\":\"/subscriptions/.../roleDefinitions/8e3af657-...\",\"principalId\":\"...\"}}",
    "statusCode": "Created"
  }
}

High-priority operationNames for detection:

operationName	Why it matters
`roleAssignments/write`	Privilege escalation — someone granted a role
`policyAssignments/write`	Policy bypass — attacker exempting resources from compliance
`virtualMachines/runCommand/action`	Code execution via Azure Run Command (T1059)
`managedIdentities/write`	Persistence via managed identity
`deployments/write`	ARM template deployment — could deploy backdoor
`networkSecurityGroups/securityRules/write`	Firewall rule modification

Stream 2: Entra ID (Azure Active Directory) Audit Logs

These capture identity plane operations:

{
  "createdDateTime": "2024-03-15T09:23:14.882Z",
  "operationName": "Add member to role",
  "result": "success",
  "initiatedBy": {
    "user": {
      "userPrincipalName": "attacker@victim.onmicrosoft.com",
      "ipAddress": "203.0.113.55"
    }
  },
  "targetResources": [
    {
      "displayName": "victim-user@victim.onmicrosoft.com",
      "modifiedProperties": [
        {
          "displayName": "Role.DisplayName",
          "newValue": "\"Global Administrator\""
        }
      ]
    }
  ]
}

High-priority Entra operations:

operationName	ATT&CK technique
`Add member to role` (Global Admin)	T1098 — Account Manipulation
`Consent to application`	T1550.001 — App consent grant (OAuth persistence)
`Add service principal`	T1136.003 — Create Cloud Account
`Update application — Certificates and secrets management (policy)`	T1098 — new app credential
`Add federated identity credential to application`	T1550 — Federated identity backdoor

Azure: Forwarding to a SIEM

Azure telemetry reaches your SIEM via:

Azure Monitor → Diagnostic Settings → Event Hub → SIEM connector (Splunk/Elastic/QRadar)
              → Log Analytics Workspace → Microsoft Sentinel
              → Storage Account → Custom ingest pipeline

For Sentinel: everything flows through Log Analytics — Activity Log, Entra ID, Defender alerts, Microsoft 365 logs. For non-Microsoft SIEMs: Event Hub is the recommended forwarding path.

GCP: Unified Cloud Audit Logs

GCP structures its audit logging with a cleaner hierarchy than AWS:

projects/<project-id>/logs/cloudaudit.googleapis.com/
  ├── activity          ← Admin Activity (always on)
  ├── data_access       ← Data Access (opt-in)
  └── system_event      ← System events (always on)

High-priority GCP methodNames:

methodName	Detection significance
`google.iam.admin.v1.CreateServiceAccountKey`	New persistent credential (T1098)
`google.iam.admin.v1.SetIamPolicy`	Permission change — check for overly permissive bindings
`google.iam.v1.IAMPolicy.SetIamPolicy`	Resource-level IAM change
`compute.instances.setMetadata`	Startup script modification — persistence via startup script
`compute.instances.oslogin.loginWithSecurityKey`	OS Login authentication
`storage.objects.get`	Object read (requires Data Access logging)

GCP IAM Policy Change Detection

{
  "protoPayload": {
    "methodName": "SetIamPolicy",
    "authenticationInfo": {
      "principalEmail": "attacker@compromised-sa.iam.gserviceaccount.com"
    },
    "request": {
      "policy": {
        "bindings": [
          {
            "role": "roles/owner",
            "members": ["user:attacker@gmail.com"]
          }
        ]
      }
    }
  }
}

A service account (@iam.gserviceaccount.com) granting the roles/owner role to an external Gmail account (@gmail.com) on a production project is a critical alert — it’s a complete project takeover from an identity outside your organization.

Azure Activity Log— Microsoft Docs GCP Cloud Audit Logs— Google Cloud Docs

Retrieval Practice

A GCP service account key is created via the GCP console by a user named 'mike@company.com'. Two hours later, the same service account makes API calls from an IP address in Eastern Europe. What fields in GCP Admin Activity logs connect these two events?

Reveal answer

Event 1 (key creation): protoPayload.methodName='google.iam.admin.v1.CreateServiceAccountKey', protoPayload.authenticationInfo.principalEmail='mike@company.com', protoPayload.resourceName contains the service account name. Event 2 (API call): protoPayload.authenticationInfo.principalEmail = the service account email (not mike@company.com — the service account is the caller now, using the key mike created), protoPayload.requestMetadata.callerIp = Eastern Europe IP. Connection: both events reference the same service account name. The key created in Event 1 is now being used in Event 2. Correlate on the service account email between the two events.

Retrieval Practice

Your Azure team tells you they have 'Azure AD logging enabled.' You need to detect OAuth app consent grants that give access to mailboxes. Which specific log stream contains these events, and what is the operationName to filter on?

Reveal answer

Entra ID (Azure Active Directory) audit logs — not the Azure Activity Log. The operationName is 'Consent to application'. You need to additionally filter on the scopes granted: look for resourceActions or modifiedProperties containing 'Mail.Read', 'Mail.ReadWrite', or 'Calendars.Read' in the delegated permissions. These logs are available in the Azure Portal under Entra ID → Monitoring → Audit logs, and can be forwarded via Diagnostic Settings to Log Analytics/Event Hub. Azure Activity Logs only show control plane operations; OAuth consent is an identity plane operation in Entra ID.