Azure route table creation or modification

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Azure Audit Log
Detection Modules	Cloud
ATT&CK Tactic	Lateral Movement (TA0008), Defense Impairment (TA0112)
ATT&CK Technique	Modify Cloud Compute Infrastructure (T1578), Network Boundary Bridging (T1599), Remote Services: Cloud Services (T1021.007)
Severity	Informational

Description

An Azure route table, or one of its individual routes, was created or modified. Azure route tables control how traffic flows between subnets and virtual networks. Adversaries can tamper with route tables to redirect traffic to attacker-controlled destinations, bypassing security appliances or enabling man-in-the-middle attacks.

Attacker's Goals

Redirect or intercept network traffic, bypass security appliances (firewalls, NVAs), or enable lateral movement between Azure subnets.

Investigative actions

• Verify whether the identity should be making route table changes.
• Inspect the route's address prefix and next-hop -- a 0.0.0.0/0 route pointing at a Virtual Appliance or an internal IP is a strong tamper indicator.
• Examine other API calls made by the identity around the same time.

Variations

Unusual Azure route table creation or modification

Synopsis

Field	Value
ATT&CK Tactic	Lateral Movement (TA0008), Defense Impairment (TA0112)
ATT&CK Technique	Modify Cloud Compute Infrastructure (T1578), Network Boundary Bridging (T1599), Remote Services: Cloud Services (T1021.007)
Severity	Low

Description

An Azure route table, or one of its individual routes, was created or modified. Azure route tables control how traffic flows between subnets and virtual networks. Adversaries can tamper with route tables to redirect traffic to attacker-controlled destinations, bypassing security appliances or enabling man-in-the-middle attacks.

Attacker's Goals

Redirect or intercept network traffic, bypass security appliances (firewalls, NVAs), or enable lateral movement between Azure subnets.

Investigative actions

• Verify whether the identity should be making route table changes.
• Inspect the route's address prefix and next-hop -- a 0.0.0.0/0 route pointing at a Virtual Appliance or an internal IP is a strong tamper indicator.
• Examine other API calls made by the identity around the same time.