Several deny actions registered

Identifies attack pattern when attacker tries to move, or scan, from resource to resource on the network and creates an incident when a source has more than 1 registered deny action in Azure Firewall.

Detection logic

Detection requirements

Platform: Containers ESXi IaaS Linux macOS Network Devices Windows
The rule states no platform. This is derived from the 3 ATT&CK techniques it maps to.
Log source product: azurefirewall
Log source service: azfwapplicationrule azfwflowtrace azfwidpssignature azfwnetworkrule azurediagnostics

Detection rules

Several deny actions registered

Detection logic

Detection requirements

MITRE ATT&CK mappings

From the source

Licence

Authorship

Detection rules