Azure SQL Server Firewall Rules Created or Modified

azure

Classification:

attack

Tactic:

TA0005-defense-evasion

Technique:

T1562-impair-defenses

Set up the azure integration.

Goal

Detect when an Azure network security rule has been created, modified, or deleted.

Strategy

Monitor Azure activity logs and detect when the @evt.name is equal to any of the following names:

  • MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/SECURITYRULES/WRITE
  • MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/SECURITYRULES/DELETE

and @evt.outcome is equal to Success.

Triage and response

Inspect the security rule and determine if it exposes any Azure resources that should not be made public.