From f75260211184dae7efc8d682af6aee02479074bd Mon Sep 17 00:00:00 2001 From: Austin Songer Date: Sun, 8 Aug 2021 22:42:08 -0500 Subject: [PATCH] Create azure_dns_zone_modified_or_deleted.yml --- .../azure_dns_zone_modified_or_deleted.yml | 43 +++++++++++++++++++ 1 file changed, 43 insertions(+) create mode 100644 rules/cloud/azure_dns_zone_modified_or_deleted.yml diff --git a/rules/cloud/azure_dns_zone_modified_or_deleted.yml b/rules/cloud/azure_dns_zone_modified_or_deleted.yml new file mode 100644 index 000000000..e5c547be8 --- /dev/null +++ b/rules/cloud/azure_dns_zone_modified_or_deleted.yml @@ -0,0 +1,43 @@ +title: Azure DNS Zone Modified or Deleted +id: af6925b0-8826-47f1-9324-337507a0babd +description: Identifies when DNS zone is modified or deleted. +author: Austin Songer +status: experimental +date: 2021/08/07 +references: + - https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes +logsource: + service: azure.activitylogs +detection: + selection: + properties.message: + - MICROSOFT.NETWORK/DNSZONES/WRITE + - MICROSOFT.NETWORK/DNSZONES/DELETE + - MICROSOFT.NETWORK/DNSZONES/A/WRITE + - MICROSOFT.NETWORK/DNSZONES/A/DELETE + - MICROSOFT.NETWORK/DNSZONES/AAAA/WRITE + - MICROSOFT.NETWORK/DNSZONES/AAAA/DELETE + - MICROSOFT.NETWORK/DNSZONES/CAA/READ + - MICROSOFT.NETWORK/DNSZONES/CAA/WRITE + - MICROSOFT.NETWORK/DNSZONES/CAA/DELETE + - MICROSOFT.NETWORK/DNSZONES/CNAME/WRITE + - MICROSOFT.NETWORK/DNSZONES/CNAME/DELETE + - MICROSOFT.NETWORK/DNSZONES/MX/WRITE + - MICROSOFT.NETWORK/DNSZONES/MX/DELETE + - MICROSOFT.NETWORK/DNSZONES/NS/WRITE + - MICROSOFT.NETWORK/DNSZONES/NS/DELETE + - MICROSOFT.NETWORK/DNSZONES/PTR/WRITE + - MICROSOFT.NETWORK/DNSZONES/PTR/DELETE + - MICROSOFT.NETWORK/DNSZONES/SOA/WRITE + - MICROSOFT.NETWORK/DNSZONES/SRV/WRITE + - MICROSOFT.NETWORK/DNSZONES/SRV/DELETE + - MICROSOFT.NETWORK/DNSZONES/TXT/WRITE + - MICROSOFT.NETWORK/DNSZONES/TXT/DELETE + condition: selection +level: medium +tags: + - attack.impact + - attack.credential_access +falsepositives: + - DNS zone modified and deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. + - DNS zone modification from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.