deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Azure Kubernetes Sensitive Role Access
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer @austinsonger
Date: 2021-08-07
ATT&CK techniques: T1485, T1496, T1489
Log source: azure/

Description:
Identifies when ClusterRoles/Roles are being modified or deleted.

Detection logic:
{
  "selection": {
    "operationName": [
      "MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/RBAC.AUTHORIZATION.K8S.IO/ROLES/WRITE",
      "MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/RBAC.AUTHORIZATION.K8S.IO/ROLES/DELETE",
      "MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/RBAC.AUTHORIZATION.K8S.IO/ROLES/BIND/ACTION",
      "MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/RBAC.AUTHORIZATION.K8S.IO/ROLES/ESCALATE/ACTION",
      "MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/RBAC.AUTHORIZATION.K8S.IO/CLUSTERROLES/WRITE",
      "MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/RBAC.AUTHORIZATION.K8S.IO/CLUSTERROLES/DELETE",
      "MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/RBAC.AUTHORIZATION.K8S.IO/CLUSTERROLES/BIND/ACTION",
      "MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/RBAC.AUTHORIZATION.K8S.IO/CLUSTERROLES/ESCALATE/ACTION"
    ]
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes
  - https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/
  - https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/
  - https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1
Sigma Detection Rule: Azure Kubernetes RoleBinding/ClusterRoleBinding Modified and Deleted
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer @austinsonger
Date: 2021-08-07
ATT&CK techniques: T1485, T1496, T1489
Log source: azure/

Description:
Detects the creation or patching of potential malicious RoleBinding/ClusterRoleBinding.

Detection logic:
{
  "selection": {
    "operationName": [
      "MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/RBAC.AUTHORIZATION.K8S.IO/CLUSTERROLEBINDINGS/WRITE",
      "MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/RBAC.AUTHORIZATION.K8S.IO/CLUSTERROLEBINDINGS/DELETE",
      "MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/RBAC.AUTHORIZATION.K8S.IO/ROLEBINDINGS/WRITE",
      "MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/RBAC.AUTHORIZATION.K8S.IO/ROLEBINDINGS/DELETE"
    ]
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes
  - https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/
  - https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/
  - https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1
Sigma Detection Rule: Granting Of Permissions To An Account
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: sawwinnnaung
Date: 2020-05-07
ATT&CK techniques: T1098.003
Log source: azure/

Description:
Identifies IPs from which users grant access to other users on azure resources and alerts when a previously unseen source IP address is used.

Detection logic:
{
  "keywords": [
    "Microsoft.Authorization/roleAssignments/write"
  ],
  "condition": "keywords"
}

References:
  - https://github.com/Azure/Azure-Sentinel/blob/e534407884b1ec5371efc9f76ead282176c9e8bb/Detections/AzureActivity/Granting_Permissions_To_Account_detection.yaml
Sigma Detection Rule: Azure Subscription Permission Elevation Via ActivityLogs
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Austin Songer @austinsonger
Date: 2021-11-26
ATT&CK techniques: T1078.004
Log source: azure/

Description:
Detects when a user has been elevated to manage all Azure Subscriptions.
This change should be investigated immediately if it isn't planned.
This setting could allow an attacker access to Azure subscriptions in your environment.


Detection logic:
{
  "selection": {
    "operationName": "MICROSOFT.AUTHORIZATION/ELEVATEACCESS/ACTION"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftauthorization
Sigma Detection Rule: Azure Active Directory Hybrid Health AD FS New Server
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC
Date: 2021-08-26
ATT&CK techniques: T1578
Log source: azure/

Description:
This detection uses azureactivity logs (Administrative category) to identify the creation or update of a server instance in an Azure AD Hybrid health AD FS service.
A threat actor can create a new AD Health ADFS service and create a fake server instance to spoof AD FS signing logs. There is no need to compromise an on-prem AD FS server.
This can be done programmatically via HTTP requests to Azure.


Detection logic:
{
  "selection": {
    "CategoryValue": "Administrative",
    "ResourceProviderValue": "Microsoft.ADHybridHealthService",
    "ResourceId|contains": "AdFederationService",
    "OperationNameValue": "Microsoft.ADHybridHealthService/services/servicemembers/action"
  },
  "condition": "selection"
}

References:
  - https://o365blog.com/post/hybridhealthagent/
Sigma Detection Rule: Azure Kubernetes Secret or Config Object Access
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer @austinsonger
Date: 2021-08-07
ATT&CK techniques: T1485, T1496, T1489
Log source: azure/

Description:
Identifies when a Kubernetes account access a sensitive objects such as configmaps or secrets.

Detection logic:
{
  "selection": {
    "operationName": [
      "MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/CONFIGMAPS/WRITE",
      "MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/CONFIGMAPS/DELETE",
      "MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/SECRETS/WRITE",
      "MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/SECRETS/DELETE"
    ]
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes
  - https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/
  - https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/
  - https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1
Sigma Detection Rule: Azure Kubernetes Admission Controller
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer @austinsonger
Date: 2021-11-25
ATT&CK techniques: T1078, T1552, T1552.007
Log source: azure/

Description:
Identifies when an admission controller is executed in Azure Kubernetes.
A Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server.
The behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster.
An adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster.
For example, attackers can intercept and modify the pod creation operations in the cluster and add their malicious container to every created pod.
An adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials.
An adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information.


Detection logic:
{
  "selection": {
    "operationName|startswith": [
      "MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/ADMISSIONREGISTRATION.K8S.IO",
      "MICROSOFT.CONTAINERSERVICE/MANAGEDCLUSTERS/ADMISSIONREGISTRATION.K8S.IO"
    ],
    "operationName|endswith": [
      "/MUTATINGWEBHOOKCONFIGURATIONS/WRITE",
      "/VALIDATINGWEBHOOKCONFIGURATIONS/WRITE"
    ]
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes
Sigma Detection Rule: Azure Network Security Configuration Modified or Deleted
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer @austinsonger
Date: 2021-08-08
Log source: azure/

Description:
Identifies when a network security configuration is modified or deleted.

Detection logic:
{
  "selection": {
    "operationName": [
      "MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/WRITE",
      "MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/DELETE",
      "MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/SECURITYRULES/WRITE",
      "MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/SECURITYRULES/DELETE",
      "MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/JOIN/ACTION",
      "MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/PROVIDERS/MICROSOFT.INSIGHTS/DIAGNOSTICSETTINGS/WRITE"
    ]
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
Sigma Detection Rule: Azure VPN Connection Modified or Deleted
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer @austinsonger
Date: 2021-08-08
Log source: azure/

Description:
Identifies when a VPN connection is modified or deleted.

Detection logic:
{
  "selection": {
    "operationName": [
      "MICROSOFT.NETWORK/VPNGATEWAYS/VPNCONNECTIONS/WRITE",
      "MICROSOFT.NETWORK/VPNGATEWAYS/VPNCONNECTIONS/DELETE"
    ]
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
Sigma Detection Rule: Azure Firewall Rule Collection Modified or Deleted
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer @austinsonger
Date: 2021-08-08
ATT&CK techniques: T1686.001
Log source: azure/

Description:
Identifies when Rule Collections (Application, NAT, and Network) is being modified or deleted.

Detection logic:
{
  "selection": {
    "operationName": [
      "MICROSOFT.NETWORK/AZUREFIREWALLS/APPLICATIONRULECOLLECTIONS/WRITE",
      "MICROSOFT.NETWORK/AZUREFIREWALLS/APPLICATIONRULECOLLECTIONS/DELETE",
      "MICROSOFT.NETWORK/AZUREFIREWALLS/NATRULECOLLECTIONS/WRITE",
      "MICROSOFT.NETWORK/AZUREFIREWALLS/NATRULECOLLECTIONS/DELETE",
      "MICROSOFT.NETWORK/AZUREFIREWALLS/NETWORKRULECOLLECTIONS/WRITE",
      "MICROSOFT.NETWORK/AZUREFIREWALLS/NETWORKRULECOLLECTIONS/DELETE"
    ]
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
Sigma Detection Rule: Azure Application Security Group Modified or Deleted
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer
Date: 2021-08-16
Log source: azure/

Description:
Identifies when a application security group is modified or deleted.

Detection logic:
{
  "selection": {
    "operationName": [
      "MICROSOFT.NETWORK/APPLICATIONSECURITYGROUPS/WRITE",
      "MICROSOFT.NETWORK/APPLICATIONSECURITYGROUPS/DELETE"
    ]
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
Sigma Detection Rule: Azure Device or Configuration Modified or Deleted
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer @austinsonger
Date: 2021-09-03
ATT&CK techniques: T1485, T1565.001
Log source: azure/

Description:
Identifies when a device or device configuration in azure is modified or deleted.

Detection logic:
{
  "selection": {
    "properties.message": [
      "Delete device",
      "Delete device configuration",
      "Update device",
      "Update device configuration"
    ]
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities#core-directory
Sigma Detection Rule: User Added to an Administrator's Azure AD Role
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Raphaël CALVET, @MetallicHack
Date: 2021-10-04
ATT&CK techniques: T1098.003, T1078
Log source: azure/

Description:
User Added to an Administrator's Azure AD Role

Detection logic:
{
  "selection": {
    "Operation": "Add member to role.",
    "Workload": "AzureActiveDirectory",
    "ModifiedProperties{}.NewValue|endswith": [
      "Admins",
      "Administrator"
    ]
  },
  "condition": "selection"
}

References:
  - https://m365internals.com/2021/07/13/what-ive-learned-from-doing-a-year-of-cloud-forensics-in-azure-ad/
Sigma Detection Rule: Azure Application Deleted
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer @austinsonger
Date: 2021-09-03
ATT&CK techniques: T1489
Log source: azure/

Description:
Identifies when a application is deleted in Azure.

Detection logic:
{
  "selection": {
    "properties.message": [
      "Delete application",
      "Hard Delete application"
    ]
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities#application-proxy
Sigma Detection Rule: Disabled MFA to Bypass Authentication Mechanisms
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: @ionsor
Date: 2022-02-08
ATT&CK techniques: T1556
Log source: azure/

Description:
Detection for when multi factor authentication has been disabled, which might indicate a malicious activity to bypass authentication mechanisms.

Detection logic:
{
  "selection": {
    "eventSource": "AzureActiveDirectory",
    "eventName": "Disable Strong Authentication.",
    "status": "success"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-userstates
Sigma Detection Rule: Azure Key Vault Modified or Deleted
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer @austinsonger
Date: 2021-08-16
ATT&CK techniques: T1552, T1552.001
Log source: azure/

Description:
Identifies when a key vault is modified or deleted.

Detection logic:
{
  "selection": {
    "operationName": [
      "MICROSOFT.KEYVAULT/VAULTS/WRITE",
      "MICROSOFT.KEYVAULT/VAULTS/DELETE",
      "MICROSOFT.KEYVAULT/VAULTS/DEPLOY/ACTION",
      "MICROSOFT.KEYVAULT/VAULTS/ACCESSPOLICIES/WRITE"
    ]
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
Sigma Detection Rule: Azure Keyvault Secrets Modified or Deleted
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer @austinsonger
Date: 2021-08-16
ATT&CK techniques: T1552, T1552.001
Log source: azure/

Description:
Identifies when secrets are modified or deleted in Azure.

Detection logic:
{
  "selection": {
    "operationName": [
      "MICROSOFT.KEYVAULT/VAULTS/SECRETS/WRITE",
      "MICROSOFT.KEYVAULT/VAULTS/SECRETS/DELETE",
      "MICROSOFT.KEYVAULT/VAULTS/SECRETS/BACKUP/ACTION",
      "MICROSOFT.KEYVAULT/VAULTS/SECRETS/PURGE/ACTION",
      "MICROSOFT.KEYVAULT/VAULTS/SECRETS/UPDATE/ACTION",
      "MICROSOFT.KEYVAULT/VAULTS/SECRETS/RECOVER/ACTION",
      "MICROSOFT.KEYVAULT/VAULTS/SECRETS/RESTORE/ACTION",
      "MICROSOFT.KEYVAULT/VAULTS/SECRETS/SETSECRET/ACTION"
    ]
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
Sigma Detection Rule: Azure Network Firewall Policy Modified or Deleted
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer @austinsonger
Date: 2021-09-02
ATT&CK techniques: T1686.001
Log source: azure/

Description:
Identifies when a Firewall Policy is Modified or Deleted.

Detection logic:
{
  "selection": {
    "operationName": [
      "MICROSOFT.NETWORK/FIREWALLPOLICIES/WRITE",
      "MICROSOFT.NETWORK/FIREWALLPOLICIES/JOIN/ACTION",
      "MICROSOFT.NETWORK/FIREWALLPOLICIES/CERTIFICATES/ACTION",
      "MICROSOFT.NETWORK/FIREWALLPOLICIES/DELETE"
    ]
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
Sigma Detection Rule: Azure Point-to-site VPN Modified or Deleted
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer @austinsonger
Date: 2021-08-08
Log source: azure/

Description:
Identifies when a Point-to-site VPN is Modified or Deleted.

Detection logic:
{
  "selection": {
    "operationName": [
      "MICROSOFT.NETWORK/P2SVPNGATEWAYS/WRITE",
      "MICROSOFT.NETWORK/P2SVPNGATEWAYS/DELETE",
      "MICROSOFT.NETWORK/P2SVPNGATEWAYS/RESET/ACTION",
      "MICROSOFT.NETWORK/P2SVPNGATEWAYS/GENERATEVPNPROFILE/ACTION",
      "MICROSOFT.NETWORK/P2SVPNGATEWAYS/DISCONNECTP2SVPNCONNECTIONS/ACTION",
      "MICROSOFT.NETWORK/P2SVPNGATEWAYS/PROVIDERS/MICROSOFT.INSIGHTS/DIAGNOSTICSETTINGS/WRITE"
    ]
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
Sigma Detection Rule: Azure New CloudShell Created
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer
Date: 2021-09-21
ATT&CK techniques: T1059
Log source: azure/

Description:
Identifies when a new cloudshell is created inside of Azure portal.

Detection logic:
{
  "selection": {
    "operationName": "MICROSOFT.PORTAL/CONSOLES/WRITE"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
Sigma Detection Rule: Azure Owner Removed From Application or Service Principal
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer @austinsonger
Date: 2021-09-03
Log source: azure/

Description:
Identifies when a owner is was removed from a application or service principal in Azure.

Detection logic:
{
  "selection": {
    "properties.message": [
      "Remove owner from service principal",
      "Remove owner from application"
    ]
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities#application-proxy
Sigma Detection Rule: Number Of Resource Creation Or Deployment Activities
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: sawwinnnaung
Date: 2020-05-07
ATT&CK techniques: T1098
Log source: azure/

Description:
Number of VM creations or deployment activities occur in Azure via the azureactivity log.

Detection logic:
{
  "keywords": [
    "Microsoft.Compute/virtualMachines/write",
    "Microsoft.Resources/deployments/write"
  ],
  "condition": "keywords"
}

References:
  - https://github.com/Azure/Azure-Sentinel/blob/e534407884b1ec5371efc9f76ead282176c9e8bb/Detections/AzureActivity/Creating_Anomalous_Number_Of_Resources_detection.yaml
Sigma Detection Rule: Azure Keyvault Key Modified or Deleted
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer @austinsonger
Date: 2021-08-16
ATT&CK techniques: T1552, T1552.001
Log source: azure/

Description:
Identifies when a Keyvault Key is modified or deleted in Azure.

Detection logic:
{
  "selection": {
    "operationName": [
      "MICROSOFT.KEYVAULT/VAULTS/KEYS/UPDATE/ACTION",
      "MICROSOFT.KEYVAULT/VAULTS/KEYS/CREATE",
      "MICROSOFT.KEYVAULT/VAULTS/KEYS/CREATE/ACTION",
      "MICROSOFT.KEYVAULT/VAULTS/KEYS/IMPORT/ACTION",
      "MICROSOFT.KEYVAULT/VAULTS/KEYS/RECOVER/ACTION",
      "MICROSOFT.KEYVAULT/VAULTS/KEYS/RESTORE/ACTION",
      "MICROSOFT.KEYVAULT/VAULTS/KEYS/DELETE",
      "MICROSOFT.KEYVAULT/VAULTS/KEYS/BACKUP/ACTION",
      "MICROSOFT.KEYVAULT/VAULTS/KEYS/PURGE/ACTION"
    ]
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
Sigma Detection Rule: Azure Virtual Network Device Modified or Deleted
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer @austinsonger
Date: 2021-08-08
Log source: azure/

Description:
Identifies when a virtual network device is being modified or deleted.
This can be a network interface, network virtual appliance, virtual hub, or virtual router.


Detection logic:
{
  "selection": {
    "operationName": [
      "MICROSOFT.NETWORK/NETWORKINTERFACES/TAPCONFIGURATIONS/WRITE",
      "MICROSOFT.NETWORK/NETWORKINTERFACES/TAPCONFIGURATIONS/DELETE",
      "MICROSOFT.NETWORK/NETWORKINTERFACES/WRITE",
      "MICROSOFT.NETWORK/NETWORKINTERFACES/JOIN/ACTION",
      "MICROSOFT.NETWORK/NETWORKINTERFACES/DELETE",
      "MICROSOFT.NETWORK/NETWORKVIRTUALAPPLIANCES/DELETE",
      "MICROSOFT.NETWORK/NETWORKVIRTUALAPPLIANCES/WRITE",
      "MICROSOFT.NETWORK/VIRTUALHUBS/DELETE",
      "MICROSOFT.NETWORK/VIRTUALHUBS/WRITE",
      "MICROSOFT.NETWORK/VIRTUALROUTERS/WRITE",
      "MICROSOFT.NETWORK/VIRTUALROUTERS/DELETE"
    ]
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
Sigma Detection Rule: Azure Application Gateway Modified or Deleted
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer
Date: 2021-08-16
Log source: azure/

Description:
Identifies when a application gateway is modified or deleted.

Detection logic:
{
  "selection": {
    "operationName": [
      "MICROSOFT.NETWORK/APPLICATIONGATEWAYS/WRITE",
      "MICROSOFT.NETWORK/APPLICATIONGATEWAYS/DELETE"
    ]
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
Sigma Detection Rule: Azure Kubernetes Events Deleted
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer @austinsonger
Date: 2021-07-24
ATT&CK techniques: T1685
Log source: azure/

Description:
Detects when Events are deleted in Azure Kubernetes. An adversary may delete events in Azure Kubernetes in an attempt to evade detection.

Detection logic:
{
  "selection": {
    "operationName": "MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/EVENTS.K8S.IO/EVENTS/DELETE"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes
  - https://github.com/elastic/detection-rules/blob/da3852b681cf1a33898b1535892eab1f3a76177a/rules/integrations/azure/defense_evasion_kubernetes_events_deleted.toml
Sigma Detection Rule: Azure Device No Longer Managed or Compliant
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer @austinsonger
Date: 2021-09-03
Log source: azure/

Description:
Identifies when a device in azure is no longer managed or compliant

Detection logic:
{
  "selection": {
    "properties.message": [
      "Device no longer compliant",
      "Device no longer managed"
    ]
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities#core-directory
Sigma Detection Rule: Azure Kubernetes Cluster Created or Deleted
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Austin Songer @austinsonger
Date: 2021-08-07
ATT&CK techniques: T1485, T1496, T1489
Log source: azure/

Description:
Detects when a Azure Kubernetes Cluster is created or deleted.

Detection logic:
{
  "selection": {
    "operationName": [
      "MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/WRITE",
      "MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/DELETE"
    ]
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes
  - https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/
  - https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/
  - https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1