Azure DevOps - Build Deleted After Pipeline Modification

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Content Index

---

Attackers may delete builds after modifying pipelines to minimize traces. This query spots such deletions within an hour of pipeline changes, aiding in system footprint reduction.

Attribute	Value
Type	Hunting Query
Solution	AzureDevOpsAuditing
ID	47857f1f-f8e6-470d-b132-03a8a606b3f4
Tactics	Persistence
Techniques	T1053
Source	View on GitHub

Tables Used

This content item queries data from the following tables:

Table	Transformations	Ingestion API	Lake-Only
ADOAuditLogs_CL	?	✓	?
AzureDevOpsAuditing	✓	✗	?

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Hunting Queries · Back to AzureDevOpsAuditing