Analytics BIOC
Informational
✕
An Azure VPN Connection was modified
Modification or removal of an Azure VPN connection was detected. This alert indicates a change to an existing VPN connection or the deletion of an existing connection.
- Module:
- Cortex Cloud
- Licensed by:
- Cloud Runtime Security (CRS)
- Data source:
- Azure Audit Log
ATT&CK tactics: Defense Evasion (TA0005)
ATT&CK techniques: Impair Defenses (T1562)
Attacker's goals:
Bypass security measures.
Investigative actions:
Check how Azure VPN Connection was modified.* Verify whether the identity should be making this action.
- Test period:
- N/A (single event)
- Deduplication:
- 5 Days