Azure Network Firewall Policy Modified or Deleted
Identifies when a Firewall Policy is Modified or Deleted.
Sigma rule (View on GitHub)
1title: Azure Network Firewall Policy Modified or Deleted
2id: 83c17918-746e-4bd9-920b-8e098bf88c23
3status: test
4description: Identifies when a Firewall Policy is Modified or Deleted.
5references:
6 - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
7author: Austin Songer @austinsonger
8date: 2021-09-02
9modified: 2022-08-23
10tags:
11 - attack.impact
12 - attack.defense-evasion
13 - attack.t1562.007
14logsource:
15 product: azure
16 service: activitylogs
17detection:
18 selection:
19 operationName:
20 - MICROSOFT.NETWORK/FIREWALLPOLICIES/WRITE
21 - MICROSOFT.NETWORK/FIREWALLPOLICIES/JOIN/ACTION
22 - MICROSOFT.NETWORK/FIREWALLPOLICIES/CERTIFICATES/ACTION
23 - MICROSOFT.NETWORK/FIREWALLPOLICIES/DELETE
24 condition: selection
25falsepositives:
26 - Firewall Policy being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
27 - Firewall Policy modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
28level: medium
References
Related rules
- Audit CVE Event
- Azure Application Deleted
- Azure Firewall Modified or Deleted
- Azure Firewall Rule Collection Modified or Deleted
- Cisco File Deletion