valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-07 17:58:52 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge pull request #1812 from austinsonger/azure_dns_zone_modified_or_deleted.yml

Browse Source 
azure_dns_zone_modified_or_deleted.yml
This commit is contained in:
frack113 2021-08-09 22:14:07 +02:00 committed by GitHub
commit 3b4d782135
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 23 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
rules/cloud/azure_dns_zone_modified_or_deleted.yml Normal file
View File

@ -0,0 +1,23 @@
title: Azure DNS Zone Modified or Deleted
id: af6925b0-8826-47f1-9324-337507a0babd
description: Identifies when DNS zone is modified or deleted.
author: Austin Songer @austinsonger
status: experimental
date: 2021/08/08
references:
- https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes
logsource:
service: azure.activitylogs
detection:
selection:
properties.message|startswith: MICROSOFT.NETWORK/DNSZONES
properties.message|endswith:
- /WRITE
- /DELETE
condition: selection
level: medium
tags:
- attack.impact
falsepositives:
- DNS zone modified and deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
- DNS zone modification from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.