Microsoft.EventHub/namespaces/eventhubs/delete

Azure

Microsoft.EventHub/namespaces/eventhubs/delete

service: Azure - Event Hubs

tactics:

Impact Defense Impairment

techniques:

T1485 T1685.002

tags:

Azure Event Hubs

Event

Permanently deletes an Azure Event Hub entity within a namespace.

Security Context

Impairing defenses allows adversaries to operate freely by removing security controls that would otherwise detect or block their activity.
Destructive deletion of cloud resources can cause significant operational disruption, data loss, and extended recovery times.

Log Source

Azure Activity Log

Sample Event

Adversarial. Compromised user draco@fantasticlogs.cloud deletes the Event Hub eh-occamy-activitylog inside the evhns-occamy-prod namespace. This Event Hub was the streaming destination for the production subscription’s Activity Log diagnostic settings — once deleted, the SIEM stops receiving Activity Log events in near-real-time. Maps to T1485 + T1685.

{
  "authorization": {
    "action": "Microsoft.EventHub/namespaces/eventhubs/delete",
    "scope": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-occamy-pipeline/providers/Microsoft.EventHub/namespaces/evhns-occamy-prod/eventhubs/eh-occamy-activitylog"
  },
  "caller": "draco@fantasticlogs.cloud",
  "channels": "Operation",
  "claims": {
    "aud": "https://management.core.windows.net/",
    "iss": "https://sts.windows.net/10000000-0000-4000-8000-000000000001/",
    "appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
    "ipaddr": "203.0.113.66",
    "name": "Draco Malfoy",
    "http://schemas.microsoft.com/identity/claims/objectidentifier": "30000000-0000-4000-8000-001010011010",
    "http://schemas.microsoft.com/identity/claims/tenantid": "10000000-0000-4000-8000-000000000001",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "draco@fantasticlogs.cloud"
  },
  "correlationId": "90000000-0000-4000-8000-000011010000",
  "description": "",
  "eventDataId": "90000000-0000-4000-8000-000011010001",
  "eventName": {
    "value": "EndRequest",
    "localizedValue": "End request"
  },
  "category": {
    "value": "Administrative",
    "localizedValue": "Administrative"
  },
  "eventTimestamp": "2026-04-15T23:08:42.5172938Z",
  "id": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-occamy-pipeline/providers/Microsoft.EventHub/namespaces/evhns-occamy-prod/eventhubs/eh-occamy-activitylog/events/90000000-0000-4000-8000-000011010001/ticks/638798306885172938",
  "level": "Informational",
  "operationId": "90000000-0000-4000-8000-000011010010",
  "operationName": {
    "value": "Microsoft.EventHub/namespaces/eventhubs/delete",
    "localizedValue": "Delete Event Hub"
  },
  "resourceGroupName": "rg-occamy-pipeline",
  "resourceProviderName": {
    "value": "Microsoft.EventHub",
    "localizedValue": "Microsoft.EventHub"
  },
  "resourceType": {
    "value": "Microsoft.EventHub/namespaces/eventhubs",
    "localizedValue": "Microsoft.EventHub/namespaces/eventhubs"
  },
  "resourceId": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-occamy-pipeline/providers/Microsoft.EventHub/namespaces/evhns-occamy-prod/eventhubs/eh-occamy-activitylog",
  "status": {
    "value": "Succeeded",
    "localizedValue": "Succeeded"
  },
  "subStatus": {
    "value": "OK",
    "localizedValue": "OK (HTTP Status Code: 200)"
  },
  "submissionTimestamp": "2026-04-15T23:08:43.0218732Z",
  "subscriptionId": "20000000-0000-4000-8000-000000000001",
  "tenantId": "10000000-0000-4000-8000-000000000001",
  "properties": {
    "statusCode": "OK",
    "serviceRequestId": null,
    "eventCategory": "Administrative",
    "entity": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-occamy-pipeline/providers/Microsoft.EventHub/namespaces/evhns-occamy-prod/eventhubs/eh-occamy-activitylog",
    "message": "Microsoft.EventHub/namespaces/eventhubs/delete",
    "hierarchy": "10000000-0000-4000-8000-000000000001/20000000-0000-4000-8000-000000000001"
  },
  "relatedEvents": [],
  "httpRequest": {
    "clientRequestId": "90000000-0000-4000-8000-000011010011",
    "clientIpAddress": "203.0.113.66",
    "method": "DELETE",
    "url": "https://management.azure.com/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-occamy-pipeline/providers/Microsoft.EventHub/namespaces/evhns-occamy-prod/eventhubs/eh-occamy-activitylog?api-version=2024-01-01"
  },
  "identity": null
}

MITRE ATT&CK Mapping

Tactics: Impact Defense Impairment

Techniques:

T1485 — Data Destruction — Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and r...
T1685.002 — Disable or Modify Cloud Log — An adversary may disable or modify cloud logging capabilities and integrations to limit what data is collected on their activities and avoid detection. Cloud environments allow for collection and analysis of audit and application logs that provide insight into what activities a user does within t...

Microsoft.EventHub/namespaces/eventhubs/delete

Event

Security Context

Log Source

Sample Event

MITRE ATT&CK Mapping

Related Events