Storm-3168 IOC IP activity across AzureActivity and AppServiceHTTPLogs

Ankit Mehta@Secvyn

•updated 7 days ago•0•0•0

This rule detects administrative or user activity within Azure via AzureActivity logs and web request patterns in AppServiceHTTPLogs that originate from a predefined list of known malicious IP addresses.