Azure Firewall Created, Modified, or Deleted

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•89

This rule identifies when an Azure Firewall resource is created, modified, or deleted within an Azure subscription. This activity is captured through Azure Activity Logs, specifically looking for 'MICROSOFT.NETWORK/AZUREFIREWALLS/WRITE' (for creation/modification) and 'MICROSOFT.NETWORK/AZUREFIREWALLS/DELETE' operations. Such changes can indicate legitimate administrative actions or potentially malicious attempts to alter network defenses.