Microsoft.Automation/automationAccounts/runbooks/write

Azure

Microsoft.Automation/automationAccounts/runbooks/write

service: Azure - Automation

tactics:

Persistence Execution

techniques:

T1072 T1059

tags:

Azure Automation

Event

Creates or updates a runbook in an Azure Automation account.

Security Context

Automation services can be weaponized to execute scripts across multiple resources simultaneously, enabling rapid lateral movement.

Log Source

Azure Activity Log

Sample Event

Adversarial. Compromised user draco@fantasticlogs.cloud creates (or modifies) the Backup-OffSite PowerShell7.2 runbook in the aa-occamy-automation Automation account. The metadata-write here only carries the runbook’s frame (name, type, description, logging flags) — the runbook draft content is uploaded as a separate operation (runbooks/draft/write) and published via runbooks/publish/action. Even so, this metadata-write event is a strong signal because runbooks aren’t typically created in production. Maps to T1072 + T1059.

{
  "authorization": {
    "action": "Microsoft.Automation/automationAccounts/runbooks/write",
    "scope": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-occamy-pipeline/providers/Microsoft.Automation/automationAccounts/aa-occamy-automation/runbooks/Backup-OffSite"
  },
  "caller": "draco@fantasticlogs.cloud",
  "channels": "Operation",
  "claims": {
    "aud": "https://management.core.windows.net/",
    "iss": "https://sts.windows.net/10000000-0000-4000-8000-000000000001/",
    "appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
    "ipaddr": "203.0.113.66",
    "name": "Draco Malfoy",
    "http://schemas.microsoft.com/identity/claims/objectidentifier": "30000000-0000-4000-8000-001010011010",
    "http://schemas.microsoft.com/identity/claims/tenantid": "10000000-0000-4000-8000-000000000001",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "draco@fantasticlogs.cloud"
  },
  "correlationId": "90000000-0000-4000-8000-000010001100",
  "description": "",
  "eventDataId": "90000000-0000-4000-8000-000010001101",
  "eventName": {
    "value": "EndRequest",
    "localizedValue": "End request"
  },
  "category": {
    "value": "Administrative",
    "localizedValue": "Administrative"
  },
  "eventTimestamp": "2026-04-15T21:02:14.5172938Z",
  "id": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-occamy-pipeline/providers/Microsoft.Automation/automationAccounts/aa-occamy-automation/runbooks/Backup-OffSite/events/90000000-0000-4000-8000-000010001101/ticks/638798223345172938",
  "level": "Informational",
  "operationId": "90000000-0000-4000-8000-000010001110",
  "operationName": {
    "value": "Microsoft.Automation/automationAccounts/runbooks/write",
    "localizedValue": "Create or Update an Azure Automation runbook"
  },
  "resourceGroupName": "rg-occamy-pipeline",
  "resourceProviderName": {
    "value": "Microsoft.Automation",
    "localizedValue": "Microsoft.Automation"
  },
  "resourceType": {
    "value": "Microsoft.Automation/automationAccounts/runbooks",
    "localizedValue": "Microsoft.Automation/automationAccounts/runbooks"
  },
  "resourceId": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-occamy-pipeline/providers/Microsoft.Automation/automationAccounts/aa-occamy-automation/runbooks/Backup-OffSite",
  "status": {
    "value": "Succeeded",
    "localizedValue": "Succeeded"
  },
  "subStatus": {
    "value": "Created",
    "localizedValue": "Created (HTTP Status Code: 201)"
  },
  "submissionTimestamp": "2026-04-15T21:02:15.1182274Z",
  "subscriptionId": "20000000-0000-4000-8000-000000000001",
  "tenantId": "10000000-0000-4000-8000-000000000001",
  "properties": {
    "statusCode": "Created",
    "serviceRequestId": null,
    "requestbody": "{\"properties\":{\"runbookType\":\"PowerShell72\",\"description\":\"Off-site backup orchestration\",\"logVerbose\":false,\"logProgress\":false,\"logActivityTrace\":0}}",
    "eventCategory": "Administrative",
    "entity": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-occamy-pipeline/providers/Microsoft.Automation/automationAccounts/aa-occamy-automation/runbooks/Backup-OffSite",
    "message": "Microsoft.Automation/automationAccounts/runbooks/write",
    "hierarchy": "10000000-0000-4000-8000-000000000001/20000000-0000-4000-8000-000000000001"
  },
  "relatedEvents": [],
  "httpRequest": {
    "clientRequestId": "90000000-0000-4000-8000-000010001111",
    "clientIpAddress": "203.0.113.66",
    "method": "PUT",
    "url": "https://management.azure.com/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-occamy-pipeline/providers/Microsoft.Automation/automationAccounts/aa-occamy-automation/runbooks/Backup-OffSite?api-version=2023-11-01"
  },
  "identity": null
}

MITRE ATT&CK Mapping

Tactics: Persistence Execution

Techniques:

T1072 — Software Deployment Tools — Adversaries may gain access to and use centralized software suites installed within an enterprise to execute commands and move laterally through the network. Configuration management and software deployment applications may be used in an enterprise network or cloud environment for routine adminis...
T1059 — Command and Scripting Interpreter — Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface a...

Microsoft.Automation/automationAccounts/runbooks/write

Event

Security Context

Log Source

Sample Event

MITRE ATT&CK Mapping

Related Events