​
Event Information

  1. The Microsoft.Network.virtualNetworks.subnets.write event in Azure for AzureNetwork refers to the action of creating or updating a subnet within a virtual network in Azure.

  2. This event indicates that a change has been made to the configuration of a subnet, such as modifying its address range, associating or disassociating network security groups, or enabling/disable service endpoints.

  3. Monitoring this event can help track changes made to subnets within a virtual network, providing visibility into network configuration modifications and helping to ensure network security and compliance.

​
Examples

  1. Unauthorized modification of subnets: If security is impacted with Microsoft.Network.virtualNetworks.subnets.write permission, an attacker could potentially modify the subnets within the AzureNetwork. This could lead to unauthorized access to resources within the subnets or disruption of network connectivity.

  2. Subnet misconfiguration: With the ability to write to subnets, an attacker could misconfigure the subnets within AzureNetwork. This could result in misrouting of network traffic, leading to potential security vulnerabilities or service disruptions.

  3. Subnet creation or deletion: The Microsoft.Network.virtualNetworks.subnets.write permission allows for the creation or deletion of subnets within AzureNetwork. An attacker with this permission could create new subnets to bypass network security controls or delete existing subnets, causing disruption to network connectivity and potentially impacting the security of resources within the network.

​
Remediation

​
Using Console

To remediate the issues mentioned in the previous response for Azure Network using the Azure console, you can follow these step-by-step instructions:

  1. Enable Network Security Groups (NSGs):

    • Go to the Azure portal and navigate to the desired Azure Network.
    • Select the “Network security groups” option from the left-hand menu.
    • Click on the “Add” button to create a new NSG or select an existing NSG.
    • Configure the NSG rules to allow only necessary inbound and outbound traffic.
    • Apply the NSG to the desired subnets or network interfaces.

  2. Implement Azure DDoS Protection Standard:

    • Go to the Azure portal and navigate to the desired Azure Network.
    • Select the “Distributed denial of service (DDoS) protection” option from the left-hand menu.
    • Click on the “Enable DDoS protection” button.
    • Choose the “Standard” tier for enhanced protection.
    • Configure the DDoS protection settings based on your requirements.
    • Apply the DDoS protection to the desired resources within the network.

  3. Implement Azure Firewall:

    • Go to the Azure portal and navigate to the desired Azure Network.
    • Select the “Azure Firewall” option from the left-hand menu.
    • Click on the “Add” button to create a new Azure Firewall or select an existing one.
    • Configure the firewall rules to allow or deny traffic based on your network security policies.
    • Associate the Azure Firewall with the desired subnets or network interfaces.
    • Monitor and manage the Azure Firewall to ensure effective network security.

Note: The above instructions provide a general guideline for remediating the mentioned issues in Azure Network using the Azure console. The specific steps may vary depending on your Azure subscription, network configuration, and security requirements. It is recommended to refer to the official Azure documentation for detailed instructions and best practices.

​
Using CLI

To remediate issues related to Azure Network using Azure CLI, you can follow these steps:

  1. Identify and resolve security group rule violations:

    • Use the az network nsg show command to retrieve the details of the Network Security Group (NSG) associated with the affected resources.
    • Review the NSG rules using az network nsg rule list command and identify any rule violations.
    • Remove or modify the offending rules using az network nsg rule delete or az network nsg rule update commands respectively.

  2. Resolve network connectivity issues:

    • Use the az network vnet-gateway show command to get information about the virtual network gateway associated with the affected resources.
    • Check the connection status using az network vnet-gateway show-bgp-peer-status command.
    • If the connection is down, use az network vnet-gateway reset command to reset the gateway.

  3. Address DNS resolution problems:

    • Use the az network private-dns record-set a list command to list the DNS records associated with the affected resources.
    • Identify any incorrect or missing DNS records.
    • Add or update the DNS records using az network private-dns record-set a add-record or az network private-dns record-set a update commands respectively.

Please note that the actual CLI commands may vary depending on your specific Azure environment and requirements.

​
Using Python

To remediate issues related to AzureNetwork using Python, you can use the Azure SDK for Python. Here are three examples of how you can remediate common issues:

  1. Example 1: Enable Network Security Group (NSG) Flow Logs

    • Use the azure.mgmt.network package to retrieve the NSG resource.
    • Enable flow logs for the NSG by setting the enable_flow_logs property to True.
    • Update the NSG resource using the network_client.network_security_groups.create_or_update method.
    from azure.identity import DefaultAzureCredential
from azure.mgmt.network import NetworkManagementClient

# Authenticate using default credentials
credential = DefaultAzureCredential()
network_client = NetworkManagementClient(credential, subscription_id)

# Retrieve the NSG resource
nsg = network_client.network_security_groups.get(resource_group_name, nsg_name)

# Enable flow logs for the NSG
nsg.enable_flow_logs = True

# Update the NSG resource
network_client.network_security_groups.create_or_update(resource_group_name, nsg_name, nsg)

  2. Example 2: Add a Network Security Rule to an NSG

    • Use the azure.mgmt.network package to retrieve the NSG resource.
    • Add a new security rule to the NSG by appending it to the security_rules list.
    • Update the NSG resource using the network_client.network_security_groups.create_or_update method.
    from azure.identity import DefaultAzureCredential
from azure.mgmt.network import NetworkManagementClient
from azure.mgmt.network.models import SecurityRule

# Authenticate using default credentials
credential = DefaultAzureCredential()
network_client = NetworkManagementClient(credential, subscription_id)

# Retrieve the NSG resource
nsg = network_client.network_security_groups.get(resource_group_name, nsg_name)

# Add a new security rule to the NSG
new_rule = SecurityRule(name="Allow-SSH", protocol="Tcp", source_port_range="*", destination_port_range="22", access="Allow", direction="Inbound")
nsg.security_rules.append(new_rule)

# Update the NSG resource
network_client.network_security_groups.create_or_update(resource_group_name, nsg_name, nsg)

  3. Example 3: Update Network Security Group Rules

    • Use the azure.mgmt.network package to retrieve the NSG resource.
    • Modify the existing security rules in the NSG as required.
    • Update the NSG resource using the network_client.network_security_groups.create_or_update method.
    from azure.identity import DefaultAzureCredential
from azure.mgmt.network import NetworkManagementClient

# Authenticate using default credentials
credential = DefaultAzureCredential()
network_client = NetworkManagementClient(credential, subscription_id)

# Retrieve the NSG resource
nsg = network_client.network_security_groups.get(resource_group_name, nsg_name)

# Modify the existing security rules in the NSG
for rule in nsg.security_rules:
    if rule.name == "Allow-SSH":
        rule.access = "Deny"

# Update the NSG resource
network_client.network_security_groups.create_or_update(resource_group_name, nsg_name, nsg)