Workspace deletion activity from an infected device

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Content Index


This query will alert on any sign-ins from devices infected with malware in correlation with workspace deletion activity. Attackers may attempt to delete workspaces containing compute instances after successful compromise to cause service unavailability to regular business operation.

Attribute Value
Type Analytic Rule
Solution Standalone Content
ID a5b3429d-f1da-42b9-883c-327ecb7b91ff
Severity Medium
Kind Scheduled
Tactics InitialAccess, Impact
Techniques T1078, T1489
Required Connectors AzureActiveDirectoryIdentityProtection, AzureActivity, BehaviorAnalytics
Source View on GitHub

Tables Used

This content item queries data from the following tables:

Table Selection Criteria Transformations Ingestion API Lake-Only
AzureActivity ActivityStatusValue has_any "Succeeded"
OperationNameValue has_any "/workspaces/computes/delete"
✗ ✗ ✗
IdentityInfo ✓ ✗ ✓
SecurityAlert AlertName == "Sign-in from an infected device"
ProductName == "Azure Active Directory Identity Protection"
✓ ✗ ✓

Associated Connectors

The following connectors provide data for this content item:

Connector Solution
AzureActiveDirectoryIdentityProtection Microsoft Entra ID Protection
AzureActivity Azure Activity

Solutions: Azure Activity, Microsoft Entra ID Protection


Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Analytic Rules