Azure Network Packet Capture Enabled

AnalysisType: rule
Filename: azure_network_packet_capture_enabled.py
RuleID: "Azure.MonitorActivity.Network.PacketCaptureEnabled"
DisplayName: "Azure Network Packet Capture Enabled"
Enabled: true
LogTypes:
  - Azure.MonitorActivity
Severity: Medium
Description: >
  Detects when Azure's Network Watcher packet capture feature is activated. 
  Packet capture operations could enable threat actors to inspect unencrypted
  network traffic and potentially extract sensitive credentials or data. While packet capture
  is a legitimate network diagnostics tool, adversaries may abuse it to sniff credentials or
  intercept sensitive data in transit.
Reports:
  MITRE ATT&CK:
    - TA0006:T1040 # Credential Access: Network Sniffing
Tags:
  - Credential Access
  - Network Sniffing
Runbook: |
  1. Query Azure Monitor Activity logs for all network diagnostic operations (packet capture start/stop, network watcher operations) by the callerIpAddress in the 24 hours before and after the alert
  2. Find all packet capture sessions started in the past 6 hours to identify the scope of potential credential sniffing activity
  3. Check if the callerIpAddress has enabled packet capture in the past 90 days to determine if this is typical network troubleshooting behavior
Reference: https://github.com/elastic/detection-rules/blob/main/rules/integrations/azure/credential_access_network_full_network_packet_capture_detected.toml
SummaryAttributes:
  - resourceId
  - location
  - callerIpAddress
  - correlationId
Tests:
  - Name: Packet Capture Started with STARTPACKETCAPTURE
    ExpectedResult: true
    Log:
      {
        "time": "2025-12-22T10:30:00.0000000Z",
        "resourceId": "/subscriptions/12345678-1234-1234-1234-123456789abc/resourceGroups/NetworkWatcherRG/providers/Microsoft.Network/networkWatchers/NetworkWatcher_eastus",
        "operationName": "MICROSOFT.NETWORK/NETWORKWATCHERS/STARTPACKETCAPTURE/ACTION",
        "operationVersion": "2021-05-01",
        "category": "Administrative",
        "resultType": "Success",
        "callerIpAddress": "1.1.1.1",
        "correlationId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
        "level": "Informational",
        "location": "eastus",
        "tenantId": "87654321-4321-4321-4321-111111111111"
      }
  - Name: VPN Packet Capture Started
    ExpectedResult: true
    Log:
      {
        "time": "2025-12-22T11:15:00.0000000Z",
        "resourceId": "/subscriptions/11111111-1111-1111-1111-111111111111/resourceGroups/NetworkWatcherRG/providers/Microsoft.Network/networkWatchers/NetworkWatcher_westeurope/vpnConnections/vpn-connection-01",
        "operationName": "MICROSOFT.NETWORK/NETWORKWATCHERS/VPNCONNECTIONS/STARTPACKETCAPTURE/ACTION",
        "category": "Administrative",
        "resultType": "Succeeded",
        "callerIpAddress": "2.2.2.2",
        "correlationId": "b2c3d4e5-f6a7-8901-bcde-f23456789012",
        "location": "westeurope",
        "tenantId": "22222222-2222-2222-2222-222222222222"
      }
  - Name: Packet Capture Write Operation
    ExpectedResult: true
    Log:
      {
        "time": "2025-12-22T12:00:00.0000000Z",
        "resourceId": "/subscriptions/33333333-3333-3333-3333-333333333333/resourceGroups/NetworkWatcherRG/providers/Microsoft.Network/networkWatchers/NetworkWatcher_centralus/packetCaptures/capture-01",
        "operationName": "MICROSOFT.NETWORK/NETWORKWATCHERS/PACKETCAPTURES/WRITE",
        "category": "Administrative",
        "resultType": "Success",
        "callerIpAddress": "3.3.3.3",
        "correlationId": "c3d4e5f6-a7b8-9012-cdef-333333333333",
        "location": "centralus",
        "tenantId": "33333333-3333-3333-3333-333333333333"
      }
  - Name: Different Operation
    ExpectedResult: false
    Log:
      {
        "time": "2025-12-22T14:00:00.0000000Z",
        "resourceId": "/subscriptions/55555555-5555-5555-5555-555555555555/resourceGroups/NetworkWatcherRG/providers/Microsoft.Network/networkWatchers/NetworkWatcher_southcentralus",
        "operationName": "MICROSOFT.NETWORK/NETWORKWATCHERS/WRITE",
        "category": "Administrative",
        "resultType": "Success",
        "callerIpAddress": "5.5.5.5",
        "correlationId": "e5f6a7b8-c9d0-1234-ef01-567890123456",
        "tenantId": "55555555-5555-5555-5555-555555555555"
      }

# ------ paired body: azure_network_packet_capture_enabled.py ------

from panther_azureactivity_helpers import azure_activity_alert_context, azure_activity_success

PACKET_CAPTURE_OPERATIONS = [
    "MICROSOFT.NETWORK/NETWORKWATCHERS/STARTPACKETCAPTURE/ACTION",
    "MICROSOFT.NETWORK/NETWORKWATCHERS/VPNCONNECTIONS/STARTPACKETCAPTURE/ACTION",
    "MICROSOFT.NETWORK/NETWORKWATCHERS/PACKETCAPTURES/WRITE",
]


def rule(event):
    operation_name = event.get("operationName", "").upper()

    return any(
        pattern in operation_name for pattern in PACKET_CAPTURE_OPERATIONS
    ) and azure_activity_success(event)


def title(event):
    location = event.get("location", "<UNKNOWN_LOCATION>")

    return f"Azure Network Packet Capture Enabled in [{location}]"


def alert_context(event):
    return azure_activity_alert_context(event)