Document Details
Normalization Content
This page contains Windows bias
About This Page
This page is part of the Azure documentation. It contains code examples and configuration instructions for working with Azure services.
Bias Analysis
Detected Bias Types
powershell_heavy
windows_tools
windows_examples
missing_linux_example
Summary
The documentation page demonstrates a notable Windows bias, especially in the Process Activity section, where many hunting queries and analytics rules focus on Windows-specific tools (PowerShell, rundll32.exe, certutil, etc.) and attack patterns. There is a lack of Linux/macOS-specific examples, tools, or queries, and no parity for Linux process, file, or session activity is provided. The registry activity section is inherently Windows-centric, and most examples reference Windows-centric threats and utilities. No Linux-specific content, such as bash scripts, Linux process monitoring, or Linux-specific threat detection, is present.
Recommendations
- Add Linux/macOS-specific analytics rules and hunting queries, e.g., detection of suspicious bash scripts, cron jobs, or Linux persistence techniques.
- Include examples for Linux process activity (e.g., monitoring suspicious use of systemd, bash, python, or SSH).
- Provide parity for file activity and session monitoring on Linux/macOS, such as detection of suspicious file changes or network connections.
- Explicitly mention Linux/macOS equivalents for Windows tools (e.g., use of curl/wget instead of PowerShell for downloads, Linux system logs instead of Windows Event Logs).
- Balance examples between Windows and Linux/macOS, or clearly indicate platform applicability for each rule/query.
Create Pull Request
Scan History
| Date | Scan | Status | Result |
|---|---|---|---|
| 2026-01-14 00:00 | #250 | in_progress |
Biased
|
| 2026-01-13 00:00 | #246 | completed |
Biased
|
| 2026-01-11 00:00 | #240 | completed |
Biased
|
| 2026-01-10 00:00 | #237 | completed |
Biased
|
| 2026-01-09 00:34 | #234 | completed |
 Clean
|
| 2026-01-08 00:53 | #231 | completed |
Biased
|
| 2026-01-06 18:15 | #225 | cancelled |
Clean
|
| 2025-08-17 00:01 | #83 | cancelled |
Clean
|
| 2025-07-13 21:37 | #48 | completed |
Biased
|
| 2025-07-12 23:44 | #41 | cancelled |
Biased
|