Elastic high stable kql

Azure Compute Restore Point Collections Deleted

Identifies multiple Azure Restore Point Collections being deleted by a single user within a short time period. Restore Point Collections contain recovery points for virtual machines, enabling point-in-time recovery capabilities. Mass deletion of these collections is a common tactic used by adversaries during ransomware attacks to prevent victim recovery or to maximize impact during destructive operations. Multiple deletions in rapid succession may indicate malicious intent.

View Source

Detection Logic

data_stream.dataset: azure.activitylogs and
    event.action: "MICROSOFT.COMPUTE/RESTOREPOINTCOLLECTIONS/DELETE" and
    event.outcome: (Success or success)

False Positives

⚠ Planned decommissioning activities or large-scale infrastructure changes may result in legitimate bulk deletion of Restore Point Collections. Verify with the user and change management processes whether these deletions are authorized. Large-scale migration or cleanup projects should be coordinated and documented to avoid false positives.

Field Validations

Loading…

Comments (0)

Loading comments...