Azure Application Gateway Modified or Deleted via Activity Logs

Alerts on Azure Activity Log operations that modify or delete Application Gateway resources.

FreeUnreviewedSigmamediumv1

azure-application-gateway-modified-or-deleted-via-activity-logs-ad87d14e

title: Azure Application Gateway Modified or Deleted via Activity Logs
id: bd65ae05-3bf4-4be7-8046-84cf8b25b08f
status: test
description: This rule flags Azure Activity Log events where an Application Gateway resource is modified (WRITE) or removed (DELETE). Attackers and misusers can use management-plane changes to disrupt availability or alter how traffic is handled. It relies on activity log telemetry capturing operation names for Application Gateways, allowing investigators to review the identity and context of the change.
references:
  - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/activity_logs/azure_application_gateway_modified_or_deleted.yml
author: Austin Songer, Huntrule Team
date: 2021-08-16
modified: 2022-08-23
tags:
  - attack.impact
logsource:
  product: azure
  service: activitylogs
detection:
  selection:
    operationName:
      - MICROSOFT.NETWORK/APPLICATIONGATEWAYS/WRITE
      - MICROSOFT.NETWORK/APPLICATIONGATEWAYS/DELETE
  condition: selection
falsepositives:
  - Application gateway being modified or deleted may be performed by a system administrator.
  - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
  - Application gateway modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: medium
license: DRL-1.1
related:
  - id: ad87d14e-7599-4633-ba81-aeb60cfe8cd6
    type: derived

What it detects

This rule flags Azure Activity Log events where an Application Gateway resource is modified (WRITE) or removed (DELETE). Attackers and misusers can use management-plane changes to disrupt availability or alter how traffic is handled. It relies on activity log telemetry capturing operation names for Application Gateways, allowing investigators to review the identity and context of the change.

Known false positives

Application gateway being modified or deleted may be performed by a system administrator.
Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
Application gateway modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.