Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
This query looks for diagnostic settings that are removed from a resource. This could indicate an attacker or malicious internal trying to evade detection before malicious act is performed. If the diagnostic settings are being deleted as part of a parent resource deletion, the event is ignores.
| Attribute | Value |
|---|---|
| Type | Analytic Rule |
| Solution | Standalone Content |
| ID | 6e95aef3-a1e0-4063-8e74-cd59aa59f245 |
| Severity | Medium |
| Kind | Scheduled |
| Tactics | DefenseEvasion |
| Techniques | T1562.008 |
| Required Connectors | AzureActivity |
| Source | View on GitHub |
This content item queries data from the following tables:
| Table | Selection Criteria | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|---|
AzureActivity |
ActivityStatusValue has_any "Success"Caller has "@"OperationNameValue == "MICROSOFT.INSIGHTS/DIAGNOSTICSETTINGS/DELETE"OperationNameValue != "MICROSOFT.INSIGHTS/DIAGNOSTICSETTINGS/DELETE"OperationNameValue endswith "/DELETE" |
✗ | ✗ | ✗ |
The following connectors provide data for this content item:
| Connector | Solution |
|---|---|
| AzureActivity | Azure Activity |
Solutions: Azure Activity
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊