Unexpected Azure API calls indicating SQL Server firewall rule modification
Description
AlphaSOC detected the successful creation or modification of an Azure SQL Server
firewall rule via Microsoft.Sql/servers/firewallRules/write, with an
unexpected action or source ASN. Firewall rules control which IP addresses can
connect to the database server. Attackers may add or widen a rule to permit
connections from infrastructure they control.
Impact
Unauthorized firewall changes can expose a database server to unwanted network access. An attacker with valid database credentials may use this access to query, modify, or exfiltrate sensitive data. Expanded access can also enable password attacks against the database.
Severity
| Severity | Condition |
|---|---|
Low | Firewall rule changed with an unexpected action or source ASN |
Medium | Firewall rule changed with both an unexpected action and source ASN |
Investigation and Remediation
Review Azure Activity logs for Microsoft.Sql/servers/firewallRules/write
events. Identify the acting identity, affected server, and IP ranges added or
modified. Compare the changes with approved network access requirements and
check database audit logs for connections or queries from unexpected addresses.
Check for a rule with both the start and end IP addresses set to 0.0.0.0,
which enables "Allow Azure services and resources to access this server". This
permits connection attempts from Azure resources in other tenants as well as
your own; database authentication is still required.
If unauthorized, restore the approved firewall configuration and investigate the acting identity. Review database activity during the exposure period and rotate any compromised database credentials.
Known False Positives
- Authorized use of the Azure portal's "Add client IP" button to enable database access
- Approved firewall changes for application deployments or administrator access