LoFP LoFP / storage administrators may legitimately delete storage accounts during decommissioning, resource cleanup, or infrastructure optimization. verify that the deletion was expected and follows organizational change management processes. consider exceptions for approved maintenance windows.

Techniques

Sample rules

Azure Storage Account Deletion by Unusual User

Description

Identifies when an Azure Storage Account is deleted. Adversaries may delete storage accounts to disrupt operations, destroy evidence, or cause denial of service. This activity could indicate an attacker attempting to cover their tracks after data exfiltration or as part of a destructive attack. Monitoring storage account deletions is critical for detecting potential impact on business operations and data availability.

Detection logic

event.dataset: azure.activitylogs and
    azure.activitylogs.operation_name: "MICROSOFT.STORAGE/STORAGEACCOUNTS/DELETE" and
    azure.activitylogs.identity.claims_initiated_by_user.name: *