Rules Contributing to Azure Application Gateway Changed Alert

The following rules are used to identify events when an Azure application's gateway is changed. Any one or more of these will trigger the Azure Application Gateway Changed Alert. Details for each rule can be viewed by clicking the More Details link in the description.

Title

Description

Azure Application Gateway Modified or Deleted

Identifies when a application gateway is modified or deleted.

More details

Rule ID

azure_78

Query

{'selection': {'operationName': ['MICROSOFT.NETWORK/APPLICATIONGATEWAYS/WRITE', 'MICROSOFT.NETWORK/APPLICATIONGATEWAYS/DELETE']}, 'condition': 'selection'}

Log Source

Stellar Cyber Microsoft Entra Events configured.

Rule Source

SigmaHQ,ad87d14e-7599-4633-ba81-aeb60cfe8cd6

Author: Austin Songer

Tactics, Techniques, and Procedures

PERSISTENCE, T1133

References

https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations

Severity

Suppression Logic Based On

azure_activity_log.resourceId
azure_activity_log.operationName
stellar.rule_id

Additional Information

Maturity	Creation Date	Risk Level	False Positives
test	2021/08/16	medium	Application gateway being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Application gateway modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.