Azure SQL Firewall Rule Manipulation

Ibrahim Saud@tektrix

•updated Jun 18, 2026•1•0•3

Detects the writing and subsequent deletion of Azure SQL firewall rules, a technique used to enable remote access and evade defenses. This behavior could indicate an adversary attempting to open up network access to an Azure SQL server and then remove the evidence of the rule change.