Azure Excessive Network Security Group Read

AnalysisType: rule
Filename: azure_network_port_mapping.py
RuleID: "Azure.MonitorActivity.Network.PortMapping"
DisplayName: "Azure Excessive Network Security Group Read"
Enabled: true
LogTypes:
  - Azure.MonitorActivity
Severity: Medium
Threshold: 50
Description: >
  Detects excessive read operations on Azure Network Security Groups. Adversaries may repeatedly
  read Network Security Group configurations to map network ports and firewall rules as part of
  reconnaissance activities. This pattern can indicate an attacker attempting to understand network
  security controls before launching lateral movement or exfiltration attacks. The threshold-based
  detection triggers when the same resource is read excessively within a time window.
Reports:
  MITRE ATT&CK:
    - TA0007:T1046 # Discovery: Network Service Discovery
    - TA0043:T1595.002 # Reconnaissance: Active Scanning - Vulnerability Scanning
Tags:
  - AZT101
  - Discovery
  - Reconnaissance
  - Network Service Discovery
  - Active Scanning
  - Vulnerability Scanning
Runbook: |
  1. Query Azure Monitor Activity logs for all Network Security Group read operations by the callerIpAddress in the 24 hours before and after the alert
  2. Check if the same caller has performed other reconnaissance activities (reading route tables, virtual networks, or other network configurations)
  3. Review the callerIpAddress and caller identity to determine if this is legitimate administrative activity or unauthorized access
  4. Verify if the threshold (50 reads) aligns with normal operational patterns for your environment
Reference: https://microsoft.github.io/Azure-Threat-Research-Matrix/Reconnaissance/AZT101/AZT101/
SummaryAttributes:
  - resourceId
  - location
  - callerIpAddress
  - correlationId
Tests:
  - Name: Network Security Group Read Success
    ExpectedResult: true
    Log:
      {
        "time": "2025-12-22T10:30:00.0000000Z",
        "resourceId": "/subscriptions/12345678-1234-1234-1234-123456789abc/resourceGroups/network-rg/providers/Microsoft.Network/networkSecurityGroups/nsg-prod",
        "operationName": "MICROSOFT.NETWORK/NETWORKSECURITYGROUP/READ",
        "operationVersion": "2021-05-01",
        "category": "Administrative",
        "resultType": "Success",
        "resultSignature": "200",
        "callerIpAddress": "1.1.1.1",
        "correlationId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
        "level": "Informational",
        "location": "eastus",
        "tenantId": "87654321-4321-4321-4321-111111111111"
      }
  - Name: Network Security Group Read Case Insensitive
    ExpectedResult: true
    Log:
      {
        "time": "2025-12-22T11:15:00.0000000Z",
        "resourceId": "/subscriptions/11111111-1111-1111-1111-111111111111/resourceGroups/network-rg/providers/Microsoft.Network/networkSecurityGroups/nsg-dev",
        "operationName": "microsoft.network/networksecuritygroup/read",
        "category": "Administrative",
        "resultType": "Succeeded",
        "callerIpAddress": "2.2.2.2",
        "correlationId": "b2c3d4e5-f6a7-8901-bcde-f23456789012",
        "level": "Information",
        "location": "westeurope",
        "tenantId": "22222222-2222-2222-2222-222222222222"
      }
  - Name: Different Operation
    ExpectedResult: false
    Log:
      {
        "time": "2025-12-22T14:00:00.0000000Z",
        "resourceId": "/subscriptions/55555555-5555-5555-5555-555555555555/resourceGroups/network-rg/providers/Microsoft.Network/virtualNetworks/myvnet",
        "operationName": "MICROSOFT.NETWORK/VIRTUALNETWORKS/READ",
        "category": "Administrative",
        "resultType": "Success",
        "callerIpAddress": "5.5.5.5",
        "correlationId": "e5f6a7b8-c9d0-1234-ef01-567890123456",
        "tenantId": "55555555-5555-5555-5555-555555555555"
      }

# ------ paired body: azure_network_port_mapping.py ------

from panther_azureactivity_helpers import azure_activity_alert_context, azure_activity_success

NETWORK_READ = "MICROSOFT.NETWORK/NETWORKSECURITYGROUP/READ"


def rule(event):
    return all(
        [
            event.get("operationName", "").upper() == NETWORK_READ,
            azure_activity_success(event),
        ]
    )


def title(event):
    resource_id = event.get("resourceId", "<UNKNOWN_RESOURCE>")
    return f"Azure Excessive Network Read on [{resource_id}]"


def alert_context(event):
    return azure_activity_alert_context(event)