Azure Virtual Network Device Modified or Deleted

 1[metadata]
 2creation_date = "2020/08/12"
 3integration = ["azure"]
 4maturity = "production"
 5min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 6min_stack_version = "8.3.0"
 7updated_date = "2023/06/22"
 8
 9[rule]
10author = ["Austin Songer"]
11description = """
12Identifies when a virtual network device is modified or deleted. This can be a network virtual appliance, virtual hub,
13or virtual router.
14"""
15false_positives = [
16    """
17    Virtual Network Device modification or deletion may be performed by a system administrator. Verify whether the user
18    identity, user agent, and/or hostname should be making changes in your environment. Virtual Network Device
19    modification or deletion by unfamiliar users should be investigated. If known behavior is causing false positives,
20    it can be exempted from the rule.
21    """,
22]
23from = "now-25m"
24index = ["filebeat-*", "logs-azure*"]
25language = "kuery"
26license = "Elastic License v2"
27name = "Azure Virtual Network Device Modified or Deleted"
28note = """## Setup
29
30The Azure Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
31references = ["https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations"]
32risk_score = 21
33rule_id = "573f6e7a-7acf-4bcd-ad42-c4969124d3c0"
34severity = "low"
35tags = ["Domain: Cloud", "Data Source: Azure", "Use Case: Network Security Monitoring", "Tactic: Impact"]
36timestamp_override = "event.ingested"
37type = "query"
38
39query = '''
40event.dataset:azure.activitylogs and azure.activitylogs.operation_name:("MICROSOFT.NETWORK/NETWORKINTERFACES/TAPCONFIGURATIONS/WRITE" or
41"MICROSOFT.NETWORK/NETWORKINTERFACES/TAPCONFIGURATIONS/DELETE" or "MICROSOFT.NETWORK/NETWORKINTERFACES/WRITE" or
42"MICROSOFT.NETWORK/NETWORKINTERFACES/JOIN/ACTION" or "MICROSOFT.NETWORK/NETWORKINTERFACES/DELETE" or
43"MICROSOFT.NETWORK/NETWORKVIRTUALAPPLIANCES/DELETE" or "MICROSOFT.NETWORK/NETWORKVIRTUALAPPLIANCES/WRITE" or
44"MICROSOFT.NETWORK/VIRTUALHUBS/DELETE" or "MICROSOFT.NETWORK/VIRTUALHUBS/WRITE" or
45"MICROSOFT.NETWORK/VIRTUALROUTERS/WRITE" or "MICROSOFT.NETWORK/VIRTUALROUTERS/DELETE") and
46event.outcome:(Success or success)
47'''
48
49
50[[rule.threat]]
51framework = "MITRE ATT&CK"
52
53[rule.threat.tactic]
54id = "TA0040"
55name = "Impact"
56reference = "https://attack.mitre.org/tactics/TA0040/"