Azure Activity Log: Network Security Group Config Modified or Deleted
Alerts on Azure Activity Log operations indicating NSG or NSG security rule changes (write/delete) that can weaken network security.
- Product
- azure
- Service
- activitylogs
- Author
- Austin Songer @austinsonger (SigmaHQ), DRL 1.1
- Published
- 2021-08-08
- Updated
- 2026-07-31
What it detects
This rule flags Azure Activity Log events where Network Security Group or related security rule configurations are written, deleted, or modified via join/join action. It also includes changes to Network Security Group diagnostic settings. Attackers may modify or remove these controls to weaken network filtering and increase access to resources, so changes are security-critical. The detection relies on Activity Log operationName events for the specified Network Security Group and security rule write/delete operations.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Azure Activity Log: Network Security Group Config Modified or Deleted"
id: d70d720e-0feb-4418-b3bb-ea4ddbe23c48
status: test
description: This rule flags Azure Activity Log events where Network Security Group or related security rule configurations are written, deleted, or modified via join/join action. It also includes changes to Network Security Group diagnostic settings. Attackers may modify or remove these controls to weaken network filtering and increase access to resources, so changes are security-critical. The detection relies on Activity Log operationName events for the specified Network Security Group and security rule write/delete operations.
references:
- https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/activity_logs/azure_network_security_modified_or_deleted.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-08-08
modified: 2022-08-23
tags:
- attack.impact
logsource:
product: azure
service: activitylogs
detection:
selection:
operationName:
- MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/WRITE
- MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/DELETE
- MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/SECURITYRULES/WRITE
- MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/SECURITYRULES/DELETE
- MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/JOIN/ACTION
- MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/PROVIDERS/MICROSOFT.INSIGHTS/DIAGNOSTICSETTINGS/WRITE
condition: selection
falsepositives:
- Network Security Configuration being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
- Network Security Configuration modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: medium
license: DRL-1.1
related:
- id: d22b4df4-5a67-4859-a578-8c9a0b5af9df
type: derived