Azure Firewall Rule Collection Modified or Deleted

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•21

This rule identifies when Azure Firewall Rule Collections (Application, NAT, and Network) are either modified or deleted. This activity can indicate an attempt to bypass network controls, potentially allowing unauthorized access or data exfiltration. Monitoring these operations is crucial for maintaining network security posture in Azure environments.