Panther medium experimental python

Azure Excessive Network Security Group Read

Detects excessive read operations on Azure Network Security Groups. Adversaries may repeatedly read Network Security Group configurations to map network ports and firewall rules as part of reconnaissance activities. This pattern can indicate an attacker attempting to understand network security controls before launching lateral movement or exfiltration attacks. The threshold-based detection triggers when the same resource is read excessively within a time window.

View Source

Detection Logic

from panther_azureactivity_helpers import azure_activity_alert_context, azure_activity_success

NETWORK_READ = "MICROSOFT.NETWORK/NETWORKSECURITYGROUP/READ"


def rule(event):
    return all(
        [
            event.get("operationName", "").upper() == NETWORK_READ,
            azure_activity_success(event),
        ]
    )


def title(event):
    resource_id = event.get("resourceId", "<UNKNOWN_RESOURCE>")
    return f"Azure Excessive Network Read on [{resource_id}]"


def alert_context(event):
    return azure_activity_alert_context(event)

Field Validations

Loading…

Comments (0)

Loading comments...