Attack Chain

1. An attacker gains initial access to an Azure account through compromised credentials or by exploiting a vulnerability.
2. The attacker identifies existing alert rules and their configurations within the Azure Security Center.
3. Using their access, the attacker creates a new alert suppression rule or modifies an existing one.
4. The suppression rule is configured to target specific alerts related to the attacker's activities. The MICROSOFT.SECURITY/ALERTSSUPPRESSIONRULES/WRITE operation is executed.
5. The Azure Activity Logs record a successful write event for the alert suppression rule.
6. With the suppression rule active, alerts related to the attacker's actions are no longer triggered, effectively evading detection.
7. The attacker continues their malicious activities, such as data exfiltration or resource exploitation, without triggering security alerts.
8. The attacker maintains persistence, knowing their activities are now less likely to be detected due to the alert suppression.

Impact

Successful exploitation of alert suppression rules can lead to a significant decrease in security visibility within Azure environments. Attackers can operate undetected, potentially leading to data breaches, unauthorized resource access, and other malicious activities. The impact is a function of how long the attacker can remain undetected while they are actively suppressing alerts related to their activities. If critical alerts are suppressed, it can result in substantial financial losses, reputational damage, and regulatory compliance violations.

Recommendation

• Deploy the Sigma rule "Azure Alert Suppression Rule Created or Modified" to your SIEM and tune for your environment to detect unauthorized changes to alert suppression rules.
• Enable Azure Activity Logs to ensure the necessary data is available for the Sigma rule to function (reference: log source in the Sigma rule).
• Review and update access controls and permissions for creating or modifying suppression rules to ensure only authorized personnel can make such changes. (reference: Overview section).
• Investigate any identified instances of alert suppression rule creation or modification to determine if they are legitimate and authorized (reference: Sigma rule description).
• Establish a baseline of expected changes and create exceptions for known maintenance periods or personnel (reference: False positive analysis section).