Azure Network Watcher Deletion

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	3 Hours
Required Data	Azure Audit Log
Detection Modules	Cloud
Detector Tags	Cloud Log Tampering Analytics
ATT&CK Tactic	Defense Impairment (TA0112)
ATT&CK Technique	Disable or Modify Tools (T1685), Disable or Modify Tools: Disable or Modify Cloud Log (T1685.002)
Severity	Low

Description

Azure Network Watchers are used for monitoring and diagnosing Azure resources. An attacker might use this technique to avoid security mitigations.

Attacker's Goals

Avoid security mitigations and detections.

Investigative actions

• Check which devices are monitored by the deleted Network Watcher.