Analytics BIOC Informational
✕

Azure Monitor alert rule deleted

An Azure Monitor alert rule was deleted. Azure Monitor alert rules watch telemetry from cloud resources and fire when suspicious or anomalous activity occurs. Adversaries may delete these rules to blind defenders and avoid detection of follow-on malicious activity.

Module:
Cortex Cloud
Licensed by:
Cloud Runtime Security (CRS)
Data source:
Azure Audit Log
ATT&CK tactics: Defense Evasion (TA0005) Execution (TA0002)
ATT&CK techniques: Impair Defenses (T1562) Impair Defenses: Disable or Modify Tools (T1562.001) Command and Scripting Interpreter: Cloud API (T1059.009)
Detector tags: Cloud Log Tampering Analytics
Attacker's goals:

Blind defenders by removing alerts that watch for suspicious cloud activity. Avoid detection of subsequent operations such as data exfiltration, lateral movement, or persistence.

Investigative actions:

Identify which alert rule was deleted (metric, scheduled query, or activity-log alert) and what it was watching. Verify whether the identity that performed the deletion is authorized to manage Azure Monitor alert rules. Check the Azure Activity Log for the caller's other recent operations in the subscription / resource group. Look for correlated suspicious activity such as resource modifications, role assignments, or diagnostic-settings changes that would normally have been alerted on. Re-create the alert rule (or restore from infrastructure-as-code) to re-establish monitoring coverage.

Test period:
N/A (single event)
Deduplication:
1 Day
2 variations:
  • Unusual Azure Monitor alert rule deletion Low (parent: Informational)
  • Azure Monitor alert rule deleted by compute workload Low (parent: Informational)