Elastic medium stable kql

Azure Storage Account Deletion by Unusual User

Identifies when an Azure Storage Account is deleted. Adversaries may delete storage accounts to disrupt operations, destroy evidence, or cause denial of service. This activity could indicate an attacker attempting to cover their tracks after data exfiltration or as part of a destructive attack. Monitoring storage account deletions is critical for detecting potential impact on business operations and data availability.

View Source

Detection Logic

data_stream.dataset: azure.activitylogs and
    azure.activitylogs.operation_name: "MICROSOFT.STORAGE/STORAGEACCOUNTS/DELETE" and
    azure.activitylogs.identity.claims_initiated_by_user.name: *

False Positives

⚠ Storage administrators may legitimately delete storage accounts during decommissioning, resource cleanup, or infrastructure optimization. Verify that the deletion was expected and follows organizational change management processes. Consider exceptions for approved maintenance windows.

Field Validations

Loading…

Comments (0)

Loading comments...