Event banner
Event details
We recently discovered that a compromised account created a Azure Virtual Machine. We were not able to see the subscription in our tenant. How would you handle the incident response for this? How often has something like this been seen in the wild?
For Azure Virtual Machines, reviewing alerts in Microsoft Defender for Cloud: https://docs.microsoft.com/en-us/azure/defender-for-cloud/tutorial-security-incident.
The reason you might not be seeing the subscription is your account might not have the rights to see the subscription, a Global Admin may have access to the subscription so I would recommend you ask a global admin in your org to see if they are able to see the subscription: https://docs.microsoft.com/en-us/azure/role-based-access-control/elevate-access-global-admin