Detectionmediumtest

Azure DNS Zone Modified or Deleted

Identifies when DNS zone is modified or deleted.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Austin SongerCreated Sun Aug 08Updated Tue Aug 23af6925b0-8826-47f1-9324-337507a0babdcloud

Log Source

Azureactivitylogs

ProductAzure← raw: azure

Serviceactivitylogs← raw: activitylogs

Detection Logic

detection:
    selection:
        operationName|startswith: 'MICROSOFT.NETWORK/DNSZONES'
        operationName|endswith:
            - '/WRITE'
            - '/DELETE'
    condition: selection

False Positives

DNS zone modified and deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.

DNS zone modification from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.

References

Resolving title…

learn.microsoft.com

MITRE ATT&CK

Tactics

TA0040 · Impact

Sub-techniques

T1565.001 · Stored Data Manipulation

Rule Metadata

Rule ID

af6925b0-8826-47f1-9324-337507a0babd