LoFP / firewall modified or deleted from unfamiliar users should be investigated. if known behavior is causing false positives, it can be exempted from the rule.

Techniques

• t1562
• t1562.004

Sample rules

Azure Firewall Modified or Deleted

• source: sigma
• technicques:
  • t1562
  • t1562.004

Description

Identifies when a firewall is created, modified, or deleted.

Detection logic

condition: selection
selection:
  operationName:
  - MICROSOFT.NETWORK/AZUREFIREWALLS/WRITE
  - MICROSOFT.NETWORK/AZUREFIREWALLS/DELETE