Forum Discussion
Where Cloudshell issued commands are logged?
AFAIK it logs the session, user etc but not commands
Go to Log Analytics and run query
AzureActivity | where ResourceGroup startswith "CLOUD-SHELL" | extend action_ = tostring(parse_json(Authorization).action) | summarize count() by ResourceGroup , Caller , CallerIpAddress , ActivityStatusValue , ActivitySubstatusValue, CategoryValue , action_// List sucess vs. failure AzureActivity | where ResourceGroup startswith "CLOUD-SHELL" | summarize count(ActivityStatus) by Caller, ActivityStatus
Rod_Trent did you test what you sent to me? your idea was the first test that I did, two weeks ago =D and NO, it doesn't work (at least not to me). And NO, it didn't show anything related Cloud Shell at AzureActivity (this was also my 'educated' guess). If you had a successful test, could you please send me a print-screen?
Microsoftjjsantanna Yes...but I'm doing to have to dig deeper. I had never thought to figure this out prior.
It does return information about Cloud Shell, but only relation to success of storage key access for the storage component for Cloud Shell that started and succeeded. This is still a solid indicator that someone initiated Cloud Shell, but it doesn't seem to record much more than that. So, I'll keep digging.
Hi Rod_Trent did you had any chance to take a look on it?
- CliveWatson
AFAIK it logs the session, user etc but not commands
Go to Log Analytics and run query
AzureActivity | where ResourceGroup startswith "CLOUD-SHELL" | extend action_ = tostring(parse_json(Authorization).action) | summarize count() by ResourceGroup , Caller , CallerIpAddress , ActivityStatusValue , ActivitySubstatusValue, CategoryValue , action_// List sucess vs. failure AzureActivity | where ResourceGroup startswith "CLOUD-SHELL" | summarize count(ActivityStatus) by Caller, ActivityStatus- CliveWatson, although your answer is "the best" it still doesn't answer my question. I've observed several attacks that after attackers compromise "the AAD" he/she issued several Cloudshell commands BUT AFAIK there is no way to determine what was done. How can I request this "feature" to the community?
