Microsoft.Automation/automationAccounts/webhooks/write

Azure

Microsoft.Automation/automationAccounts/webhooks/write

service: Azure - Automation

tactics:

Persistence Execution

techniques:

T1072 T1546

tags:

Azure Automation

Event

Creates or updates a webhook that can trigger an Azure Automation runbook remotely.

Security Context

Automation services can be weaponized to execute scripts across multiple resources simultaneously, enabling rapid lateral movement.

Log Source

Azure Activity Log

Sample Event

Adversarial. Compromised user draco@fantasticlogs.cloud creates a webhook named webhook-backup-offsite bound to the Backup-OffSite runbook with a maximum 10-year expiry. The webhook URL (returned in the HTTP response, NOT logged in Activity Log) is the persistence primitive — anyone with that URL can trigger the runbook anonymously. Maps to T1072 (Software Deployment Tools) + T1546 (Event Triggered Execution).

{
  "authorization": {
    "action": "Microsoft.Automation/automationAccounts/webhooks/write",
    "scope": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-occamy-pipeline/providers/Microsoft.Automation/automationAccounts/aa-occamy-automation/webhooks/webhook-backup-offsite"
  },
  "caller": "draco@fantasticlogs.cloud",
  "channels": "Operation",
  "claims": {
    "aud": "https://management.core.windows.net/",
    "iss": "https://sts.windows.net/10000000-0000-4000-8000-000000000001/",
    "appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
    "ipaddr": "203.0.113.66",
    "name": "Draco Malfoy",
    "http://schemas.microsoft.com/identity/claims/objectidentifier": "30000000-0000-4000-8000-001010011010",
    "http://schemas.microsoft.com/identity/claims/tenantid": "10000000-0000-4000-8000-000000000001",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "draco@fantasticlogs.cloud"
  },
  "correlationId": "90000000-0000-4000-8000-000010010100",
  "description": "",
  "eventDataId": "90000000-0000-4000-8000-000010010101",
  "eventName": {
    "value": "EndRequest",
    "localizedValue": "End request"
  },
  "category": {
    "value": "Administrative",
    "localizedValue": "Administrative"
  },
  "eventTimestamp": "2026-04-15T21:14:08.5183194Z",
  "id": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-occamy-pipeline/providers/Microsoft.Automation/automationAccounts/aa-occamy-automation/webhooks/webhook-backup-offsite/events/90000000-0000-4000-8000-000010010101/ticks/638798230485183194",
  "level": "Informational",
  "operationId": "90000000-0000-4000-8000-000010010110",
  "operationName": {
    "value": "Microsoft.Automation/automationAccounts/webhooks/write",
    "localizedValue": "Create or Update an Azure Automation webhook"
  },
  "resourceGroupName": "rg-occamy-pipeline",
  "resourceProviderName": {
    "value": "Microsoft.Automation",
    "localizedValue": "Microsoft.Automation"
  },
  "resourceType": {
    "value": "Microsoft.Automation/automationAccounts/webhooks",
    "localizedValue": "Microsoft.Automation/automationAccounts/webhooks"
  },
  "resourceId": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-occamy-pipeline/providers/Microsoft.Automation/automationAccounts/aa-occamy-automation/webhooks/webhook-backup-offsite",
  "status": {
    "value": "Succeeded",
    "localizedValue": "Succeeded"
  },
  "subStatus": {
    "value": "Created",
    "localizedValue": "Created (HTTP Status Code: 201)"
  },
  "submissionTimestamp": "2026-04-15T21:14:09.0218739Z",
  "subscriptionId": "20000000-0000-4000-8000-000000000001",
  "tenantId": "10000000-0000-4000-8000-000000000001",
  "properties": {
    "statusCode": "Created",
    "serviceRequestId": null,
    "requestbody": "{\"properties\":{\"isEnabled\":true,\"expiryTime\":\"2036-04-15T21:14:08+00:00\",\"runbook\":{\"name\":\"Backup-OffSite\"},\"runOn\":\"hybrid-worker-occamy-01\",\"parameters\":{}}}",
    "eventCategory": "Administrative",
    "entity": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-occamy-pipeline/providers/Microsoft.Automation/automationAccounts/aa-occamy-automation/webhooks/webhook-backup-offsite",
    "message": "Microsoft.Automation/automationAccounts/webhooks/write",
    "hierarchy": "10000000-0000-4000-8000-000000000001/20000000-0000-4000-8000-000000000001"
  },
  "relatedEvents": [],
  "httpRequest": {
    "clientRequestId": "90000000-0000-4000-8000-000010010111",
    "clientIpAddress": "203.0.113.66",
    "method": "PUT",
    "url": "https://management.azure.com/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-occamy-pipeline/providers/Microsoft.Automation/automationAccounts/aa-occamy-automation/webhooks/webhook-backup-offsite?api-version=2023-11-01"
  },
  "identity": null
}

MITRE ATT&CK Mapping

Tactics: Persistence Execution

Techniques:

T1072 — Software Deployment Tools — Adversaries may gain access to and use centralized software suites installed within an enterprise to execute commands and move laterally through the network. Configuration management and software deployment applications may be used in an enterprise network or cloud environment for routine adminis...
T1546 — Event Triggered Execution — Adversaries may establish persistence and/or elevate privileges using system mechanisms that trigger execution based on specific events. Various operating systems have means to monitor and subscribe to events such as logons or other user activity such as running specific applications/binaries. Cl...

Microsoft.Automation/automationAccounts/webhooks/write

Event

Security Context

Log Source

Sample Event

MITRE ATT&CK Mapping

Related Events