Microsoft.Insights/metricAlerts/delete
Azure
Microsoft.Insights/metricAlerts/delete
Event
Deletes an Azure Monitor metric alert rule.
Security Context
- Impairing defenses allows adversaries to operate freely by removing security controls that would otherwise detect or block their activity.
Log Source
Azure Activity Log
Sample Event
Adversarial. draco@fantasticlogs.cloud deletes the metric alert rule phoenix-vm-cpu-spike-alert in resource group rg-phoenix-dr, removing an alert that would have fired on anomalous CPU spikes (a typical proxy for cryptomining or attacker workloads on the PHOENIX backup VMs Draco intends to abuse next).
{ "authorization": { "action": "Microsoft.Insights/metricAlerts/delete", "scope": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-phoenix-dr/providers/Microsoft.Insights/metricAlerts/phoenix-vm-cpu-spike-alert" }, "caller": "draco@fantasticlogs.cloud", "channels": "Operation", "claims": { "aud": "https://management.core.windows.net/", "iss": "https://sts.windows.net/10000000-0000-4000-8000-000000000001/", "iat": "1776592800", "nbf": "1776592800", "exp": "1776681600", "appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46", "appidacr": "0", "ipaddr": "203.0.113.66", "name": "Draco Malfoy", "http://schemas.microsoft.com/identity/claims/objectidentifier": "30000000-0000-4000-8000-001010011010", "puid": "1003200000000666", "http://schemas.microsoft.com/identity/claims/tenantid": "10000000-0000-4000-8000-000000000001", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "draco@fantasticlogs.cloud", "http://schemas.microsoft.com/identity/claims/wids": "e8611ab8-c189-46e8-94e1-60213ab1f814", "uti": "metricDel201ExampleUt", "ver": "1.0" }, "correlationId": "90000000-0000-4000-8000-000011111101", "description": "", "eventDataId": "90000000-0000-4000-8000-000011111110", "eventName": { "value": "EndRequest", "localizedValue": "End request" }, "category": { "value": "Administrative", "localizedValue": "Administrative" }, "eventTimestamp": "2026-04-15T17:41:33.7218845Z", "id": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-phoenix-dr/providers/Microsoft.Insights/metricAlerts/phoenix-vm-cpu-spike-alert/events/90000000-0000-4000-8000-000011111110/ticks/638798221937218845", "level": "Informational", "operationId": "90000000-0000-4000-8000-000011111111", "operationName": { "value": "Microsoft.Insights/metricAlerts/delete", "localizedValue": "Delete metricAlerts" }, "resourceGroupName": "rg-phoenix-dr", "resourceProviderName": { "value": "Microsoft.Insights", "localizedValue": "Microsoft Insights" }, "resourceType": { "value": "Microsoft.Insights/metricAlerts", "localizedValue": "Microsoft.Insights/metricAlerts" }, "resourceId": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-phoenix-dr/providers/Microsoft.Insights/metricAlerts/phoenix-vm-cpu-spike-alert", "status": { "value": "Succeeded", "localizedValue": "Succeeded" }, "subStatus": { "value": "OK", "localizedValue": "OK (HTTP Status Code: 200)" }, "submissionTimestamp": "2026-04-15T17:41:34.1102554Z", "subscriptionId": "20000000-0000-4000-8000-000000000001", "tenantId": "10000000-0000-4000-8000-000000000001", "properties": { "statusCode": "OK", "serviceRequestId": null, "eventCategory": "Administrative", "entity": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-phoenix-dr/providers/Microsoft.Insights/metricAlerts/phoenix-vm-cpu-spike-alert", "message": "Microsoft.Insights/metricAlerts/delete", "hierarchy": "10000000-0000-4000-8000-000000000001/20000000-0000-4000-8000-000000000001" }, "relatedEvents": []}MITRE ATT&CK Mapping
Tactics: Defense Impairment
Techniques:
- T1685 — Disable or Modify Tools — Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities. This may include stopping spec...