Azure Activity Logs: Alert Suppression Rule Created

Flags when an Azure alert suppression rule is created via the security alerts suppression write operation.

FreeUnreviewedSigmamediumv1

azure-activity-logs-alert-suppression-rule-created-92cc3e5d

title: "Azure Activity Logs: Alert Suppression Rule Created"
id: 94fcf510-1d29-4c20-9bb1-87752d811232
status: test
description: This rule identifies creation of an Azure alert suppression rule by matching the Activity Log operation MICROSOFT.SECURITY/ALERTSSUPPRESSIONRULES/WRITE. Attackers may use suppression to reduce visibility and hinder security monitoring by muting detections. The detection relies on Azure Activity Logs event fields that record the operation name associated with the write action.
references:
  - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/activity_logs/azure_suppression_rule_created.yml
author: Austin Songer, Huntrule Team
date: 2021-08-16
modified: 2022-08-23
tags:
  - attack.impact
logsource:
  product: azure
  service: activitylogs
detection:
  selection:
    operationName: MICROSOFT.SECURITY/ALERTSSUPPRESSIONRULES/WRITE
  condition: selection
falsepositives:
  - Suppression Rule being created may be performed by a system administrator.
  - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
  - Suppression Rule created from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: medium
license: DRL-1.1
related:
  - id: 92cc3e5d-eb57-419d-8c16-5c63f325a401
    type: derived

What it detects

This rule identifies creation of an Azure alert suppression rule by matching the Activity Log operation MICROSOFT.SECURITY/ALERTSSUPPRESSIONRULES/WRITE. Attackers may use suppression to reduce visibility and hinder security monitoring by muting detections. The detection relies on Azure Activity Logs event fields that record the operation name associated with the write action.

Known false positives

Suppression Rule being created may be performed by a system administrator.
Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
Suppression Rule created from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.