Azure Firewall Created, Modified, or Deleted via Azure Activity Logs

Alerts on Azure Firewall write or delete events in Azure Activity Logs, signaling potential defense impairment.

FreeUnreviewedSigmamediumv1

azure-firewall-created-modified-or-deleted-via-azure-activity-logs-512cf937

title: Azure Firewall Created, Modified, or Deleted via Azure Activity Logs
id: 348c9da1-06a5-4024-ad91-655ad81cc9bc
status: test
description: This rule flags Azure Activity Log events where an Azure Firewall is written or deleted. Unauthorized or unexpected changes to a firewall can indicate defense impairment by disrupting or replacing network filtering controls. Detection relies on Azure Activity Logs operationName values for MICROSOFT.NETWORK/AZUREFIREWALLS/WRITE and MICROSOFT.NETWORK/AZUREFIREWALLS/DELETE.
references:
  - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/activity_logs/azure_firewall_modified_or_deleted.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-08-08
modified: 2022-08-23
tags:
  - attack.impact
  - attack.defense-impairment
  - attack.t1686.001
logsource:
  product: azure
  service: activitylogs
detection:
  selection:
    operationName:
      - MICROSOFT.NETWORK/AZUREFIREWALLS/WRITE
      - MICROSOFT.NETWORK/AZUREFIREWALLS/DELETE
  condition: selection
falsepositives:
  - Firewall being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
  - Firewall modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: medium
license: DRL-1.1
related:
  - id: 512cf937-ea9b-4332-939c-4c2c94baadcd
    type: derived

What it detects

This rule flags Azure Activity Log events where an Azure Firewall is written or deleted. Unauthorized or unexpected changes to a firewall can indicate defense impairment by disrupting or replacing network filtering controls. Detection relies on Azure Activity Logs operationName values for MICROSOFT.NETWORK/AZUREFIREWALLS/WRITE and MICROSOFT.NETWORK/AZUREFIREWALLS/DELETE.

Known false positives

Firewall being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
Firewall modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.