​
Event Information

  • The Microsoft.Network.dnszones.delete event in Azure for AzureNetwork indicates that a DNS zone has been deleted within the Azure Network.
  • This event signifies that the DNS zone, which is used for managing the domain name resolution within the Azure Network, has been removed.
  • It is important to note that deleting a DNS zone will result in the loss of all associated DNS records and configurations, so caution should be exercised before performing this action.

​
Examples

  1. Unauthorized deletion: If security is impacted with Microsoft.Network.dnszones.delete in Azure for AzureNetwork, it could mean that an unauthorized user or entity has gained access to the Azure Network and is able to delete DNS zones. This could lead to a loss of DNS resolution for the affected network, potentially impacting the availability and accessibility of services hosted within the network.

  2. Data exfiltration: In some cases, the deletion of DNS zones could be used as a cover for data exfiltration. By deleting DNS zones, an attacker may attempt to remove any traces of their activities or to disrupt network monitoring and detection mechanisms. This could allow them to exfiltrate sensitive data from the Azure Network without being detected.

  3. Service disruption: Deleting DNS zones can result in a significant disruption of services within the Azure Network. DNS resolution is critical for the proper functioning of many network services, including web applications, email servers, and virtual private networks (VPNs). If DNS zones are deleted, these services may become inaccessible, leading to a loss of productivity and potential financial impact for the organization.

​
Remediation

​
Using Console

To remediate the issues mentioned in the previous response for Azure Network using the Azure console, you can follow these step-by-step instructions:

  1. Enable Network Security Groups (NSGs):

    • Go to the Azure portal and navigate to the desired Azure Network.
    • Select the “Network security groups” option from the left-hand menu.
    • Click on the “Add” button to create a new NSG or select an existing NSG.
    • Configure the NSG rules to allow only necessary inbound and outbound traffic.
    • Apply the NSG to the desired subnets or network interfaces.

  2. Implement Azure DDoS Protection Standard:

    • Go to the Azure portal and navigate to the desired Azure Network.
    • Select the “Distributed denial of service (DDoS) protection” option from the left-hand menu.
    • Click on the “Enable DDoS protection” button.
    • Choose the “Standard” tier for enhanced protection.
    • Configure the DDoS protection settings based on your requirements.
    • Apply the DDoS protection to the desired resources within the network.

  3. Implement Azure Firewall:

    • Go to the Azure portal and navigate to the desired Azure Network.
    • Select the “Azure Firewall” option from the left-hand menu.
    • Click on the “Add” button to create a new Azure Firewall or select an existing one.
    • Configure the firewall rules to allow or deny traffic based on your network security policies.
    • Associate the Azure Firewall with the desired subnets or network interfaces.
    • Monitor and manage the Azure Firewall to ensure effective network security.

Note: The above instructions provide a general guideline for remediating the mentioned issues in Azure Network using the Azure console. The specific steps may vary depending on your Azure subscription, network configuration, and security requirements. It is recommended to refer to the official Azure documentation for detailed instructions and best practices.

​
Using CLI

To remediate issues related to Azure Network using Azure CLI, you can use the following commands:

  1. Example 1: Enable Network Security Group (NSG) Flow Logs

    • Command: az network watcher flow-log configure
    • Description: This command enables flow logs for a specific NSG, allowing you to capture and analyze network traffic.
    • Parameters: You need to provide the resource group name, NSG name, storage account ID, and storage account key.

  2. Example 2: Restrict Network Access using Network Security Groups (NSGs)

    • Command: az network nsg rule create
    • Description: This command creates a new rule in an NSG to restrict network access based on specific criteria.
    • Parameters: You need to provide the resource group name, NSG name, rule name, priority, source/destination IP addresses, ports, and action.

  3. Example 3: Enable Azure DDoS Protection Standard

    • Command: az network ddos-protection update
    • Description: This command enables Azure DDoS Protection Standard for a specific virtual network, providing protection against DDoS attacks.
    • Parameters: You need to provide the resource group name and virtual network name.

Note: The provided commands are examples and may require additional parameters based on your specific requirements. Make sure to refer to the official Azure CLI documentation for detailed usage and options.

​
Using Python

To remediate issues related to AzureNetwork using Python, you can use the Azure SDK for Python. Here are three examples of how you can remediate common issues:

  1. Example 1: Enable Network Security Group (NSG) Flow Logs

    • Use the azure.mgmt.network package to retrieve the NSG resource.
    • Enable flow logs for the NSG by setting the enable_flow_logs property to True.
    • Update the NSG resource using the network_client.network_security_groups.create_or_update method.
    from azure.identity import DefaultAzureCredential
from azure.mgmt.network import NetworkManagementClient

# Authenticate using default credentials
credential = DefaultAzureCredential()
network_client = NetworkManagementClient(credential, subscription_id)

# Retrieve the NSG resource
nsg = network_client.network_security_groups.get(resource_group_name, nsg_name)

# Enable flow logs for the NSG
nsg.enable_flow_logs = True

# Update the NSG resource
network_client.network_security_groups.create_or_update(resource_group_name, nsg_name, nsg)

  2. Example 2: Add a Network Security Rule to an NSG

    • Use the azure.mgmt.network package to retrieve the NSG resource.
    • Add a new security rule to the NSG by appending it to the security_rules list.
    • Update the NSG resource using the network_client.network_security_groups.create_or_update method.
    from azure.identity import DefaultAzureCredential
from azure.mgmt.network import NetworkManagementClient

# Authenticate using default credentials
credential = DefaultAzureCredential()
network_client = NetworkManagementClient(credential, subscription_id)

# Retrieve the NSG resource
nsg = network_client.network_security_groups.get(resource_group_name, nsg_name)

# Add a new security rule to the NSG
nsg.security_rules.append({
    'name': 'Allow-SSH',
    'protocol': 'Tcp',
    'source_port_range': '*',
    'destination_port_range': '22',
    'source_address_prefix': '*',
    'destination_address_prefix': '*',
    'access': 'Allow',
    'priority': 100,
    'direction': 'Inbound'
})

# Update the NSG resource
network_client.network_security_groups.create_or_update(resource_group_name, nsg_name, nsg)

  3. Example 3: Update Virtual Network Subnet

    • Use the azure.mgmt.network package to retrieve the virtual network resource.
    • Update the subnet properties, such as the address prefix, by modifying the subnets list.
    • Update the virtual network resource using the network_client.virtual_networks.create_or_update method.
    from azure.identity import DefaultAzureCredential
from azure.mgmt.network import NetworkManagementClient

# Authenticate using default credentials
credential = DefaultAzureCredential()
network_client = NetworkManagementClient(credential, subscription_id)

# Retrieve the virtual network resource
vnet = network_client.virtual_networks.get(resource_group_name, vnet_name)

# Update the subnet properties
for subnet in vnet.subnets:
    if subnet.name == subnet_name:
        subnet.address_prefix = '10.0.0.0/24'

# Update the virtual network resource
network_client.virtual_networks.create_or_update(resource_group_name, vnet_name, vnet)