LoFP / virtual network modified or deleted from unfamiliar users should be investigated. if known behavior is causing false positives, it can be exempted from the rule.

Techniques

Sample rules

Azure Virtual Network Modified or Deleted

source: sigma
technicques:

Description

Identifies when a Virtual Network is modified or deleted in Azure.

Detection logic

condition: selection
selection:
  operationName|endswith:
  - /WRITE
  - /DELETE
  operationName|startswith:
  - MICROSOFT.NETWORK/VIRTUALNETWORKGATEWAYS/
  - MICROSOFT.NETWORK/VIRTUALNETWORKS/