Azure Automation Runbook Deletion

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Azure Audit Log
Detection Modules	Cloud
ATT&CK Tactic	Impact (TA0040), Defense Impairment (TA0112)
ATT&CK Technique	Disable or Modify Tools (T1685), Service Stop (T1489)
Severity	Informational

Description

An Azure Automation runbook was deleted. This could disrupt business automation processes or remove a malicious runbook that was part of an attack.

Attacker's Goals

Stop business services.

Investigative actions

• Check which runbook was deleted and whether it is malicious or valid.