← Back to SOC feed Coverage →

Detect Azure RemoteIP

kql MEDIUM Azure-Sentinel
DeviceNetworkEvents
huntingmicrosoftofficial
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Azure-Sentinel →
Retrieved: 2026-05-22T11:00:00Z · Confidence: medium

Hunt Hypothesis

Adversaries may use Azure IP addresses to mask their origin, making it harder to trace their activity within Azure environments. SOC teams should proactively hunt for this behavior to identify potential lateral movement or command-and-control traffic disguised as legitimate Azure traffic.

KQL Query

let AzureSubnets = toscalar (
    externaldata (xml:string)
    [
        @'https://download.microsoft.com/download/0/1/8/018E208D-54F8-44CD-AA26-CD7BC9524A8C/PublicIPs_20200824.xml'
    ]
    with (format="txt")
    | extend Subnet = tostring(parse_xml(xml).IpRange.['@Subnet'])
    | where isnotempty(Subnet)
    | summarize make_set(Subnet)
);
let IsItAzure = (SourceData:(RemoteIP:string)) {
    SourceData
    | extend AzureSubnet = AzureSubnets
    | mv-expand AzureSubnet to typeof(string)
    | extend IsAzure = ipv4_is_in_range(RemoteIP, AzureSubnet)
    | summarize IsAzure = max(IsAzure) by RemoteIP
};
// BEGIN SAMPLE QUERY //
DeviceNetworkEvents
| take 10000
// END SAMPLE QUERY
| invoke IsItAzure()

Analytic Rule Definition

id: a883cf6b-52dd-480a-8581-4e5774fc9002
name: Detect Azure RemoteIP
description: |
  This query is a function that consumes the publicly available Azure IP address list and checks a list of remote IP addresses against it to see if they are Azure IP addresses or not.
  To use this, replace the demo portion of the query (DeviceNetworkEvents | take 10000) with your query with the column name of the IP address to check named RemoteIP. The function will add a new column to the end called IsAzure denoting if the IP address range is in the published list or not.
  Please note that over time the URL to the Azure IP address list may need to be updated.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceNetworkEvents
query: |
  let AzureSubnets = toscalar (
      externaldata (xml:string)
      [
          @'https://download.microsoft.com/download/0/1/8/018E208D-54F8-44CD-AA26-CD7BC9524A8C/PublicIPs_20200824.xml'
      ]
      with (format="txt")
      | extend Subnet = tostring(parse_xml(xml).IpRange.['@Subnet'])
      | where isnotempty(Subnet)
      | summarize make_set(Subnet)
  );
  let IsItAzure = (SourceData:(RemoteIP:string)) {
      SourceData
      | extend AzureSubnet = AzureSubnets
      | mv-expand AzureSubnet to typeof(string)
      | extend IsAzure = ipv4_is_in_range(RemoteIP, AzureSubnet)
      | summarize IsAzure = max(IsAzure) by RemoteIP
  };
  // BEGIN SAMPLE QUERY //
  DeviceNetworkEvents
  | take 10000
  // END SAMPLE QUERY
  | invoke IsItAzure()

Required Data Sources

Sentinel TableNotes
DeviceNetworkEventsEnsure this data connector is enabled

References

False Positive Guidance

Original source: https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/General queries/Detect Azure RemoteIP.yaml