detection.wiki

Detection rules › Sigma

Azure Firewall Rule Collection Modified or Deleted

Status
test
Severity
medium
Log source
product azure, service activitylogs
Author
Austin Songer @austinsonger
Source
github.com/SigmaHQ/sigma

Identifies when Rule Collections (Application, NAT, and Network) is being modified or deleted.

Known false positives

  • Rule Collections (Application, NAT, and Network) being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
  • Rule Collections (Application, NAT, and Network) modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.

MITRE ATT&CK coverage

TacticTechniques
Defense Impairment

Telemetry coverage

PlatformRecord / event type
AzureActivity Log event Microsoft.Network/azureFirewalls/applicationRuleCollections/delete: Deletes Azure Firewall ApplicationRuleCollection
AzureActivity Log event Microsoft.Network/azureFirewalls/applicationRuleCollections/write: CreatesOrUpdates Azure Firewall ApplicationRuleCollection
AzureActivity Log event Microsoft.Network/azureFirewalls/natRuleCollections/delete: Deletes Azure Firewall NatRuleCollection
AzureActivity Log event Microsoft.Network/azureFirewalls/natRuleCollections/write: CreatesOrUpdates Azure Firewall NatRuleCollection
AzureActivity Log event Microsoft.Network/azureFirewalls/networkRuleCollections/delete: Deletes Azure Firewall NetworkRuleCollection
AzureActivity Log event Microsoft.Network/azureFirewalls/networkRuleCollections/write: CreatesOrUpdates Azure Firewall NetworkRuleCollection

Rule body

title: Azure Firewall Rule Collection Modified or Deleted
id: 025c9fe7-db72-49f9-af0d-31341dd7dd57
status: test
description: Identifies when Rule Collections (Application, NAT, and Network) is being modified or deleted.
references:
    - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
author: Austin Songer @austinsonger
date: 2021-08-08
modified: 2022-08-23
tags:
    - attack.impact
    - attack.defense-impairment
    - attack.t1686.001
logsource:
    product: azure
    service: activitylogs
detection:
    selection:
        operationName:
            - MICROSOFT.NETWORK/AZUREFIREWALLS/APPLICATIONRULECOLLECTIONS/WRITE
            - MICROSOFT.NETWORK/AZUREFIREWALLS/APPLICATIONRULECOLLECTIONS/DELETE
            - MICROSOFT.NETWORK/AZUREFIREWALLS/NATRULECOLLECTIONS/WRITE
            - MICROSOFT.NETWORK/AZUREFIREWALLS/NATRULECOLLECTIONS/DELETE
            - MICROSOFT.NETWORK/AZUREFIREWALLS/NETWORKRULECOLLECTIONS/WRITE
            - MICROSOFT.NETWORK/AZUREFIREWALLS/NETWORKRULECOLLECTIONS/DELETE
    condition: selection
falsepositives:
    - Rule Collections (Application, NAT, and Network) being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
    - Rule Collections (Application, NAT, and Network) modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: medium

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
    operationName:
        - MICROSOFT.NETWORK/AZUREFIREWALLS/APPLICATIONRULECOLLECTIONS/WRITE
        - MICROSOFT.NETWORK/AZUREFIREWALLS/APPLICATIONRULECOLLECTIONS/DELETE
        - MICROSOFT.NETWORK/AZUREFIREWALLS/NATRULECOLLECTIONS/WRITE
        - MICROSOFT.NETWORK/AZUREFIREWALLS/NATRULECOLLECTIONS/DELETE
        - MICROSOFT.NETWORK/AZUREFIREWALLS/NETWORKRULECOLLECTIONS/WRITE
        - MICROSOFT.NETWORK/AZUREFIREWALLS/NETWORKRULECOLLECTIONS/DELETE

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
operationNameeq
  • MICROSOFT.NETWORK/AZUREFIREWALLS/APPLICATIONRULECOLLECTIONS/DELETE
  • MICROSOFT.NETWORK/AZUREFIREWALLS/APPLICATIONRULECOLLECTIONS/WRITE
  • MICROSOFT.NETWORK/AZUREFIREWALLS/NATRULECOLLECTIONS/DELETE
  • MICROSOFT.NETWORK/AZUREFIREWALLS/NATRULECOLLECTIONS/WRITE
  • MICROSOFT.NETWORK/AZUREFIREWALLS/NETWORKRULECOLLECTIONS/DELETE
  • MICROSOFT.NETWORK/AZUREFIREWALLS/NETWORKRULECOLLECTIONS/WRITE
field:"operationName" kind:eq