Microsoft.Network/virtualNetworks/virtualNetworkPeerings/write

Azure

Microsoft.Network/virtualNetworks/virtualNetworkPeerings/write

service: Azure - Network

tactics:

Lateral Movement Defense Impairment

techniques:

T1599

tags:

Azure Network

Event

Creates or modifies a virtual network peering, enabling network connectivity for lateral movement across VNets.

Security Context

• Virtual network peering creates direct network connectivity between VNets, bypassing internet routing and enabling traffic flow between previously isolated network segments.
• Adversaries create peering connections to bridge into isolated VNets containing sensitive workloads, databases, or management infrastructure that were intentionally segmented from the compromised network.

Log Source

Azure Activity Log

Sample Event

Adversarial. draco@fantasticlogs.cloud creates a peering from the production VNet vnet-prod-eastus to a previously-isolated security/management VNet vnet-security-eastus (in the security subscription). This bridges the two networks, providing direct route to security tooling and the SIEM ingestion VNet from the compromised production network.

{
  "authorization": {
    "action": "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/write",
    "scope": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-fantasticlogs-prod/providers/Microsoft.Network/virtualNetworks/vnet-prod-eastus/virtualNetworkPeerings/prod-to-security-peering"
  },
  "caller": "draco@fantasticlogs.cloud",
  "channels": "Operation",
  "claims": {
    "appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
    "ipaddr": "203.0.113.66",
    "name": "Draco Malfoy",
    "http://schemas.microsoft.com/identity/claims/objectidentifier": "30000000-0000-4000-8000-001010011010",
    "puid": "1003200000000666",
    "http://schemas.microsoft.com/identity/claims/tenantid": "10000000-0000-4000-8000-000000000001",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "draco@fantasticlogs.cloud",
    "http://schemas.microsoft.com/identity/claims/wids": "e8611ab8-c189-46e8-94e1-60213ab1f814",
    "uti": "vnetPeer209ExampleUti",
    "ver": "1.0"
  },
  "correlationId": "90000000-0000-4000-8000-000100011000",
  "description": "",
  "eventDataId": "90000000-0000-4000-8000-000100011001",
  "eventName": {
    "value": "EndRequest",
    "localizedValue": "End request"
  },
  "category": {
    "value": "Administrative",
    "localizedValue": "Administrative"
  },
  "eventTimestamp": "2026-04-15T18:38:11.3211087Z",
  "id": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-fantasticlogs-prod/providers/Microsoft.Network/virtualNetworks/vnet-prod-eastus/virtualNetworkPeerings/prod-to-security-peering/events/90000000-0000-4000-8000-000100011001/ticks/638798256913211087",
  "level": "Informational",
  "operationId": "90000000-0000-4000-8000-000100011010",
  "operationName": {
    "value": "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/write",
    "localizedValue": "Create or Update Virtual Network Peering"
  },
  "resourceGroupName": "rg-fantasticlogs-prod",
  "resourceProviderName": {
    "value": "Microsoft.Network",
    "localizedValue": "Microsoft.Network"
  },
  "resourceType": {
    "value": "Microsoft.Network/virtualNetworks/virtualNetworkPeerings",
    "localizedValue": "Microsoft.Network/virtualNetworks/virtualNetworkPeerings"
  },
  "resourceId": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-fantasticlogs-prod/providers/Microsoft.Network/virtualNetworks/vnet-prod-eastus/virtualNetworkPeerings/prod-to-security-peering",
  "status": {
    "value": "Succeeded",
    "localizedValue": "Succeeded"
  },
  "subStatus": {
    "value": "Created",
    "localizedValue": "Created (HTTP Status Code: 201)"
  },
  "submissionTimestamp": "2026-04-15T18:38:11.8902154Z",
  "subscriptionId": "20000000-0000-4000-8000-000000000001",
  "tenantId": "10000000-0000-4000-8000-000000000001",
  "properties": {
    "statusCode": "Created",
    "serviceRequestId": null,
    "eventCategory": "Administrative",
    "entity": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-fantasticlogs-prod/providers/Microsoft.Network/virtualNetworks/vnet-prod-eastus/virtualNetworkPeerings/prod-to-security-peering",
    "message": "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/write",
    "hierarchy": "10000000-0000-4000-8000-000000000001/20000000-0000-4000-8000-000000000001",
    "requestbody": "{\"properties\":{\"allowVirtualNetworkAccess\":true,\"allowForwardedTraffic\":true,\"allowGatewayTransit\":false,\"useRemoteGateways\":false,\"remoteVirtualNetwork\":{\"id\":\"/subscriptions/20000000-0000-4000-8000-000000000010/resourceGroups/rg-security/providers/Microsoft.Network/virtualNetworks/vnet-security-eastus\"}}}"
  },
  "relatedEvents": []
}

MITRE ATT&CK Mapping

Tactics: Lateral Movement Defense Impairment

Techniques:

• T1599 — Network Boundary Bridging — Adversaries may bridge network boundaries by compromising perimeter network devices or internal devices responsible for network segmentation. Breaching these devices may enable an adversary to bypass restrictions on traffic routing that otherwise separate trusted and untrusted networks.