Document Details
Normalization Content
This page contains Windows bias
About This Page
This page is part of the Azure documentation. It contains code examples and configuration instructions for working with Azure services.
Bias Analysis
Detected Bias Types
windows_tools
powershell_heavy
missing_linux_example
windows_first
Summary
The documentation page exhibits a Windows bias in several ways: many analytic rules and hunting queries focus on Windows-specific tools (e.g., rundll32.exe, PowerShell, certutil, Exchange PowerShell Snapin), and there is a notable absence of Linux-specific examples or references to Linux tools and patterns. The majority of process activity examples are Windows-centric, and PowerShell usage is highlighted repeatedly without mention of Linux shell equivalents. No Linux-specific threats, commands, or detection patterns are provided, and Windows terminology (e.g., registry, UAC bypass) is used exclusively or first.
Recommendations
- Add Linux-specific analytic rules and hunting queries, such as detection of suspicious bash, python, or perl scripts, or Linux persistence techniques (e.g., cron jobs, systemd services).
- Include examples of Linux command-line tools (e.g., grep, awk, systemctl) and detection of common Linux attack patterns (e.g., SSH brute force, sudo abuse, rootkit installation).
- Balance the coverage of Windows and Linux by providing parity in threat detection scenarios, such as both Windows and Linux privilege escalation, process monitoring, and file activity.
- Explicitly mention Linux equivalents when referencing Windows tools (e.g., PowerShell vs. bash/zsh, certutil vs. openssl), and provide hunting queries for both platforms.
- Highlight cross-platform threats and detection strategies, ensuring that examples and documentation do not assume a Windows-only environment.
Create Pull Request
Scan History
| Date | Scan | Status | Result |
|---|---|---|---|
| 2026-01-14 00:00 | #250 | in_progress |
Biased
|
| 2026-01-13 00:00 | #246 | completed |
Biased
|
| 2026-01-11 00:00 | #240 | completed |
Biased
|
| 2026-01-10 00:00 | #237 | completed |
Biased
|
| 2026-01-09 00:34 | #234 | completed |
 Clean
|
| 2026-01-08 00:53 | #231 | completed |
Biased
|
| 2026-01-06 18:15 | #225 | cancelled |
Clean
|
| 2025-08-17 00:01 | #83 | cancelled |
Clean
|
| 2025-07-13 21:37 | #48 | completed |
Biased
|
| 2025-07-12 23:44 | #41 | cancelled |
Biased
|