Monitoring of applications hosted in Azure identified multiple HTTP requests targeting web applications running through Azure App Services.
The observed traffic included repeated GET and POST attempts generated by external bots.
Event Location
Location: Azure
The targeted systems were web applications hosted as Azure App Services.
Observed Activity
Multiple HTTP requests were directed toward the applications.
The observed activity consisted of repeated:
HTTP GET attempts;
HTTP POST attempts.
The requests were generated by external bots targeting the Azure-hosted web applications.
Why the Activity Was Notable
Publicly accessible web applications can receive automated traffic from external sources.
When the number or pattern of these requests changes significantly, the activity can become visible as an anomaly in monitoring.
In this case, the detected activity was associated with multiple automated GET and POST attempts generated by external bots.
Investigation Context
The important context is that the requests were directed at web applications exposed through Azure App Services and originated from external bots.
Reviewing this activity by application, request type, and source can help distinguish the automated traffic from the normal application request pattern.
Security Context
The supplied information identifies repeated external bot requests but does not identify a successful compromise.
The confirmed observation is that multiple external bots generated GET and POST attempts against Azure-hosted web applications.
Conclusion
The Azure anomaly was caused by repeated HTTP requests targeting App Services hosting web applications.
Multiple GET and POST attempts generated by external bots created the abnormal request pattern observed by monitoring.
