Multiple Network Security Group Modifications

Ankit Mehta@Secvyn

•updated Jun 30, 2026•2•0•4

This rule detects when a single caller performs five or more successful 'Create or Update Network Security Group' operations within a one-hour window in Azure Activity logs. This could indicate an attacker attempting to modify network access controls to facilitate lateral movement, C2, or data exfiltration, or a misconfigured automated process.