Azure Network Firewall Policy Modified or Deleted via Activity Logs

Alerts on Azure Activity Log operations that modify or delete Network Firewall Policies.

FreeUnreviewedSigmamediumv1

azure-network-firewall-policy-modified-or-deleted-via-activity-logs-83c17918

title: Azure Network Firewall Policy Modified or Deleted via Activity Logs
id: e20e1355-cfb9-45f1-a791-97e97d746a9a
status: test
description: This rule flags Azure Activity Log events where a Network Firewall Policy is written, joined/certificates actions are taken, or the policy is deleted. Attackers may impair or disrupt network protections by changing or removing firewall policy configuration. It relies on Azure Activity Log telemetry capturing operation names for Firewall Policy write/join/certificate actions and delete operations.
references:
  - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/activity_logs/azure_network_firewall_policy_modified_or_deleted.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-09-02
modified: 2022-08-23
tags:
  - attack.impact
  - attack.defense-impairment
  - attack.t1686.001
logsource:
  product: azure
  service: activitylogs
detection:
  selection:
    operationName:
      - MICROSOFT.NETWORK/FIREWALLPOLICIES/WRITE
      - MICROSOFT.NETWORK/FIREWALLPOLICIES/JOIN/ACTION
      - MICROSOFT.NETWORK/FIREWALLPOLICIES/CERTIFICATES/ACTION
      - MICROSOFT.NETWORK/FIREWALLPOLICIES/DELETE
  condition: selection
falsepositives:
  - Firewall Policy being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
  - Firewall Policy modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: medium
license: DRL-1.1
related:
  - id: 83c17918-746e-4bd9-920b-8e098bf88c23
    type: derived

What it detects

This rule flags Azure Activity Log events where a Network Firewall Policy is written, joined/certificates actions are taken, or the policy is deleted. Attackers may impair or disrupt network protections by changing or removing firewall policy configuration. It relies on Azure Activity Log telemetry capturing operation names for Firewall Policy write/join/certificate actions and delete operations.

Known false positives

Firewall Policy being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
Firewall Policy modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.