Rules Contributing to Azure DNS Zone Changed Alert

The following rules are used to identify events when an Azure DNS zone is changed. Any one or more of these will trigger the Azure DNS Zone Changed Alert. Details for each rule can be viewed by clicking the More Details link in the description.

Title

Description

Azure DNS Zone Modified or Deleted

Identifies when DNS zone is modified or deleted.

Rule ID

azure_73

Query

{'selection': {'operationName|startswith': 'MICROSOFT.NETWORK/DNSZONES', 'operationName|endswith': ['/WRITE', '/DELETE']}, 'condition': 'selection'}

Log Source

Stellar Cyber Microsoft Entra Events configured.

Rule Source

SigmaHQ,af6925b0-8826-47f1-9324-337507a0babd

Author: Austin Songer @austinsonger

Tactics, Techniques, and Procedures

COMMAND_AND_CONTROL, T1071.004

References

Severity

50

Suppression Logic Based On

  • azure_activity_log.resourceId
  • azure_activity_log.operationName
  • stellar.rule_id

Additional Information

Maturity Creation Date Risk Level False Positives
test 2021/08/08 medium

  • DNS zone modified and deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.

  • DNS zone modification from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.