From b9f84bedc55609d7c195ba53e13617ecbfc2aec1 Mon Sep 17 00:00:00 2001
From: Austin Songer <austin@songer.pro>
Date: Sun, 8 Aug 2021 22:52:15 -0500
Subject: [PATCH] Create azure_network_virtual_device_modified_or_deleted.yml

---
 ...ork_virtual_device_modified_or_deleted.yml | 29 +++++++++++++++++++
 1 file changed, 29 insertions(+)
 create mode 100644 rules/cloud/azure_network_virtual_device_modified_or_deleted.yml

diff --git a/rules/cloud/azure_network_virtual_device_modified_or_deleted.yml b/rules/cloud/azure_network_virtual_device_modified_or_deleted.yml
new file mode 100644
index 000000000..85027a0b9
--- /dev/null
+++ b/rules/cloud/azure_network_virtual_device_modified_or_deleted.yml
@@ -0,0 +1,29 @@
+title: Azure Virtual Network Device Modified or Deleted
+id: 15ef3fac-f0f0-4dc4-ada0-660aa72980b3
+description: Identifies when a virtual network device is being modified or deleted. This can be a network interface, network virtual applicance, vitual hub, or virtual router.
+author: Austin Songer
+status: experimental
+date: 2021/08/08
+references:
+    - https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
+logsource:
+  service: azure.activitylogs
+detection:
+    selection:
+        properties.message: 
+            - MICROSOFT.NETWORK/NETWORKINTERFACES/WRITE
+            - MICROSOFT.NETWORK/NETWORKINTERFACES/JOIN/ACTION
+            - MICROSOFT.NETWORK/NETWORKINTERFACES/DELETE
+            - MICROSOFT.NETWORK/NETWORKVIRTUALAPPLIANCES/DELETE
+            - MICROSOFT.NETWORK/NETWORKVIRTUALAPPLIANCES/WRITE
+            - MICROSOFT.NETWORK/VIRTUALHUBS/DELETE
+            - MICROSOFT.NETWORK/VIRTUALHUBS/WRITE
+            - MICROSOFT.NETWORK/VIRTUALROUTERS/WRITE
+            - MICROSOFT.NETWORK/VIRTUALROUTERS/DELETE
+    condition: selection
+level: medium
+tags:
+    - attack.impact
+falsepositives:
+ - Virtual Network Device being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. 
+ - Virtual Network Device modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.