valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-07 01:45:21 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge pull request #1813 from austinsonger/azure_virtual_network_modified_or_deleted.yml

Browse Source 
azure_virtual_network_modified_or_deleted.yml
This commit is contained in:
frack113 2021-08-10 06:22:25 +02:00 committed by GitHub
commit a1917b4247
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 25 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
rules/cloud/azure_virtual_network_modified_or_deleted.yml Normal file
View File

@ -0,0 +1,25 @@
title: Azure Virtual Network Modified or Deleted
id: bcfcc962-0e4a-4fd9-84bb-a833e672df3f
description: Identifies when a Virtual Network is modified or deleted in Azure.
author: Austin Songer @austinsonger
status: experimental
date: 2021/08/08
references:
- https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
logsource:
service: azure.activitylogs
detection:
selection:
properties.message|startswith:
- MICROSOFT.NETWORK/VIRTUALNETWORKGATEWAYS/
- MICROSOFT.NETWORK/VIRTUALNETWORKS/
properties.message|endswith:
- /WRITE
- /DELETE
condition: selection
level: medium
tags:
- attack.impact
falsepositives:
- Virtual Network being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
- Virtual Network modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.