An Azure VPN Connection was modified

Synopsis

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	5 Days
Required Data	Requires: Azure Audit Log
Detection Modules	Cloud
ATT&CK Tactic	Defense Evasion (TA0005)
ATT&CK Technique	Impair Defenses (T1562)
Severity	Informational

Description

Modification or removal of an Azure VPN connection was detected. This alert indicates a change to an existing VPN connection, or the deletion of an existing connection.

Attacker's Goals

Bypass security measures.

Investigative actions

Check how Azure VPN Connection was modified.
Verify whether the identity should be making this action.