Azure Monitor alert rule deleted

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Azure Audit Log
Detection Modules	Cloud
Detector Tags	Cloud Log Tampering Analytics
ATT&CK Tactic	Execution (TA0002), Defense Impairment (TA0112)
ATT&CK Technique	Disable or Modify Tools (T1685), Command and Scripting Interpreter: Cloud API (T1059.009)
Severity	Informational

Description

An Azure Monitor alert rule was deleted. Azure Monitor alert rules watch telemetry from cloud resources and fire when suspicious or anomalous activity occurs. Adversaries may delete these rules to blind defenders and avoid detection of follow-on malicious activity.

Attacker's Goals

• Blind defenders by removing alerts that watch for suspicious cloud activity.
• Avoid detection of subsequent operations such as data exfiltration, lateral movement, or persistence.

Investigative actions

• Identify which alert rule was deleted (metric, scheduled query, or activity-log alert) and what it was watching.
• Verify whether the identity that performed the deletion is authorized to manage Azure Monitor alert rules.
• Check the Azure Activity Log for the caller's other recent operations in the subscription / resource group.
• Look for correlated suspicious activity such as resource modifications, role assignments, or diagnostic-settings changes that would normally have been alerted on.
• Re-create the alert rule (or restore from infrastructure-as-code) to re-establish monitoring coverage.

Variations

Unusual Azure Monitor alert rule deletion

Synopsis

Field	Value
ATT&CK Tactic	Execution (TA0002), Defense Impairment (TA0112)
ATT&CK Technique	Disable or Modify Tools (T1685), Command and Scripting Interpreter: Cloud API (T1059.009)
Severity	Low

Description

An Azure Monitor alert rule was deleted. Azure Monitor alert rules watch telemetry from cloud resources and fire when suspicious or anomalous activity occurs. Adversaries may delete these rules to blind defenders and avoid detection of follow-on malicious activity.

Attacker's Goals

• Blind defenders by removing alerts that watch for suspicious cloud activity.
• Avoid detection of subsequent operations such as data exfiltration, lateral movement, or persistence.

Investigative actions

• Identify which alert rule was deleted (metric, scheduled query, or activity-log alert) and what it was watching.
• Verify whether the identity that performed the deletion is authorized to manage Azure Monitor alert rules.
• Check the Azure Activity Log for the caller's other recent operations in the subscription / resource group.
• Look for correlated suspicious activity such as resource modifications, role assignments, or diagnostic-settings changes that would normally have been alerted on.
• Re-create the alert rule (or restore from infrastructure-as-code) to re-establish monitoring coverage.

Azure Monitor alert rule deleted by compute workload

Synopsis

Field	Value
ATT&CK Tactic	Execution (TA0002), Defense Impairment (TA0112)
ATT&CK Technique	Disable or Modify Tools (T1685), Command and Scripting Interpreter: Cloud API (T1059.009)
Severity	Low

Description

An Azure Monitor alert rule was deleted. Azure Monitor alert rules watch telemetry from cloud resources and fire when suspicious or anomalous activity occurs. Adversaries may delete these rules to blind defenders and avoid detection of follow-on malicious activity.

Attacker's Goals

• Blind defenders by removing alerts that watch for suspicious cloud activity.
• Avoid detection of subsequent operations such as data exfiltration, lateral movement, or persistence.

Investigative actions

• Identify which alert rule was deleted (metric, scheduled query, or activity-log alert) and what it was watching.
• Verify whether the identity that performed the deletion is authorized to manage Azure Monitor alert rules.
• Check the Azure Activity Log for the caller's other recent operations in the subscription / resource group.
• Look for correlated suspicious activity such as resource modifications, role assignments, or diagnostic-settings changes that would normally have been alerted on.
• Re-create the alert rule (or restore from infrastructure-as-code) to re-establish monitoring coverage.