Azure Virtual Network Device Modified or Deleted

 1[metadata]
 2creation_date = "2020/08/12"
 3integration = ["azure"]
 4maturity = "production"
 5updated_date = "2024/05/21"
 6
 7[rule]
 8author = ["Austin Songer"]
 9description = """
10Identifies when a virtual network device is modified or deleted. This can be a network virtual appliance, virtual hub,
11or virtual router.
12"""
13false_positives = [
14    """
15    Virtual Network Device modification or deletion may be performed by a system administrator. Verify whether the user
16    identity, user agent, and/or hostname should be making changes in your environment. Virtual Network Device
17    modification or deletion by unfamiliar users should be investigated. If known behavior is causing false positives,
18    it can be exempted from the rule.
19    """,
20]
21from = "now-25m"
22index = ["filebeat-*", "logs-azure*"]
23language = "kuery"
24license = "Elastic License v2"
25name = "Azure Virtual Network Device Modified or Deleted"
26note = """## Setup
27
28The Azure Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
29references = ["https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations"]
30risk_score = 21
31rule_id = "573f6e7a-7acf-4bcd-ad42-c4969124d3c0"
32severity = "low"
33tags = ["Domain: Cloud", "Data Source: Azure", "Use Case: Network Security Monitoring", "Tactic: Impact"]
34timestamp_override = "event.ingested"
35type = "query"
36
37query = '''
38event.dataset:azure.activitylogs and azure.activitylogs.operation_name:("MICROSOFT.NETWORK/NETWORKINTERFACES/TAPCONFIGURATIONS/WRITE" or
39"MICROSOFT.NETWORK/NETWORKINTERFACES/TAPCONFIGURATIONS/DELETE" or "MICROSOFT.NETWORK/NETWORKINTERFACES/WRITE" or
40"MICROSOFT.NETWORK/NETWORKINTERFACES/JOIN/ACTION" or "MICROSOFT.NETWORK/NETWORKINTERFACES/DELETE" or
41"MICROSOFT.NETWORK/NETWORKVIRTUALAPPLIANCES/DELETE" or "MICROSOFT.NETWORK/NETWORKVIRTUALAPPLIANCES/WRITE" or
42"MICROSOFT.NETWORK/VIRTUALHUBS/DELETE" or "MICROSOFT.NETWORK/VIRTUALHUBS/WRITE" or
43"MICROSOFT.NETWORK/VIRTUALROUTERS/WRITE" or "MICROSOFT.NETWORK/VIRTUALROUTERS/DELETE") and
44event.outcome:(Success or success)
45'''
46
47
48[[rule.threat]]
49framework = "MITRE ATT&CK"
50
51[rule.threat.tactic]
52id = "TA0040"
53name = "Impact"
54reference = "https://attack.mitre.org/tactics/TA0040/"