Azure Resource Group Deletion

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	3 Hours
Required Data	Azure Audit Log
Detection Modules	Cloud
ATT&CK Tactic	Impact (TA0040), Defense Impairment (TA0112)
ATT&CK Technique	Data Destruction (T1485), Disable or Modify Tools (T1685), Disable or Modify Tools: Disable or Modify Cloud Log (T1685.002)
Severity	Informational

Description

Resource group deletion permanently deletes all resources within the group, An attacker might use this technique to avoid detection or destroy procedures/data.

Attacker's Goals

Evade detection.

Investigative actions

• Check which resource group was deleted.