Azure Activity Logs: Network Security Group Security Rules Modified or Deleted

Alerts on Azure Activity Log operations indicating NSG or NSG security rule changes (write/delete) that can weaken network security.

FreeUnreviewedSigmamediumv1

azure-activity-logs-network-security-group-security-rules-modified-or-deleted-d22b4df4

title: "Azure Activity Logs: Network Security Group Security Rules Modified or Deleted"
id: d70d720e-0feb-4418-b3bb-ea4ddbe23c48
status: test
description: This rule identifies Azure Activity Log events where a Network Security Group (NSG) or its security rules are written or deleted, including NSG and NSG security rule changes. Attackers may modify or remove NSG controls to weaken network filtering and enable unauthorized access. It relies on Activity Logs operationName matches for NSG write/delete operations and security rule write/delete operations, along with related NSG join/action and diagnostic settings write activity.
references:
  - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/activity_logs/azure_network_security_modified_or_deleted.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-08-08
modified: 2022-08-23
tags:
  - attack.impact
logsource:
  product: azure
  service: activitylogs
detection:
  selection:
    operationName:
      - MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/WRITE
      - MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/DELETE
      - MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/SECURITYRULES/WRITE
      - MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/SECURITYRULES/DELETE
      - MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/JOIN/ACTION
      - MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/PROVIDERS/MICROSOFT.INSIGHTS/DIAGNOSTICSETTINGS/WRITE
  condition: selection
falsepositives:
  - Network Security Configuration being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
  - Network Security Configuration modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: medium
license: DRL-1.1
related:
  - id: d22b4df4-5a67-4859-a578-8c9a0b5af9df
    type: derived

What it detects

This rule identifies Azure Activity Log events where a Network Security Group (NSG) or its security rules are written or deleted, including NSG and NSG security rule changes. Attackers may modify or remove NSG controls to weaken network filtering and enable unauthorized access. It relies on Activity Logs operationName matches for NSG write/delete operations and security rule write/delete operations, along with related NSG join/action and diagnostic settings write activity.

Known false positives

Network Security Configuration being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
Network Security Configuration modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.