Skip to content
TheCloud.Events

Microsoft.Network/networkSecurityGroups/delete

Azure

Microsoft.Network/networkSecurityGroups/delete

service: Azure - Network Security Group
tactics:
Defense Impairment
techniques:
T1686.001
tags:
Azure Network Security Group

Event

Deletes a network security group, removing network access controls from associated resources.

Security Context

  • Deleting a network security group removes all inbound and outbound traffic filtering rules from associated subnets and NICs, leaving resources exposed to unrestricted network access.
  • Adversaries delete NSGs to remove network-level defenses, enabling direct access to previously protected resources or opening egress paths for data exfiltration.

Log Source

Azure Activity Log

Sample Event

Adversarial. draco@fantasticlogs.cloud deletes the NSG nsg-demiguise-prod from rg-fantasticlogs-prod. Removing the NSG strips its inbound and outbound rules from any subnets/NICs it was associated with, opening unrestricted network access for follow-on lateral movement and exfiltration paths.

{
  "authorization": {
    "action": "Microsoft.Network/networkSecurityGroups/delete",
    "scope": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-fantasticlogs-prod/providers/Microsoft.Network/networkSecurityGroups/nsg-demiguise-prod"
  },
  "caller": "draco@fantasticlogs.cloud",
  "channels": "Operation",
  "claims": {
    "appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
    "ipaddr": "203.0.113.66",
    "name": "Draco Malfoy",
    "http://schemas.microsoft.com/identity/claims/objectidentifier": "30000000-0000-4000-8000-001010011010",
    "puid": "1003200000000666",
    "http://schemas.microsoft.com/identity/claims/tenantid": "10000000-0000-4000-8000-000000000001",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "draco@fantasticlogs.cloud",
    "http://schemas.microsoft.com/identity/claims/wids": "e8611ab8-c189-46e8-94e1-60213ab1f814",
    "uti": "nsgDel206ExampleUtid01",
    "ver": "1.0"
  },
  "correlationId": "90000000-0000-4000-8000-000100001111",
  "description": "",
  "eventDataId": "90000000-0000-4000-8000-000100010000",
  "eventName": {
    "value": "EndRequest",
    "localizedValue": "End request"
  },
  "category": {
    "value": "Administrative",
    "localizedValue": "Administrative"
  },
  "eventTimestamp": "2026-04-15T18:31:18.5042088Z",
  "id": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-fantasticlogs-prod/providers/Microsoft.Network/networkSecurityGroups/nsg-demiguise-prod/events/90000000-0000-4000-8000-000100010000/ticks/638798252385042088",
  "level": "Informational",
  "operationId": "90000000-0000-4000-8000-000100010001",
  "operationName": {
    "value": "Microsoft.Network/networkSecurityGroups/delete",
    "localizedValue": "Delete Network Security Group"
  },
  "resourceGroupName": "rg-fantasticlogs-prod",
  "resourceProviderName": {
    "value": "Microsoft.Network",
    "localizedValue": "Microsoft.Network"
  },
  "resourceType": {
    "value": "Microsoft.Network/networkSecurityGroups",
    "localizedValue": "Microsoft.Network/networkSecurityGroups"
  },
  "resourceId": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-fantasticlogs-prod/providers/Microsoft.Network/networkSecurityGroups/nsg-demiguise-prod",
  "status": {
    "value": "Succeeded",
    "localizedValue": "Succeeded"
  },
  "subStatus": {
    "value": "OK",
    "localizedValue": "OK (HTTP Status Code: 200)"
  },
  "submissionTimestamp": "2026-04-15T18:31:19.0851117Z",
  "subscriptionId": "20000000-0000-4000-8000-000000000001",
  "tenantId": "10000000-0000-4000-8000-000000000001",
  "properties": {
    "statusCode": "OK",
    "serviceRequestId": null,
    "eventCategory": "Administrative",
    "entity": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-fantasticlogs-prod/providers/Microsoft.Network/networkSecurityGroups/nsg-demiguise-prod",
    "message": "Microsoft.Network/networkSecurityGroups/delete",
    "hierarchy": "10000000-0000-4000-8000-000000000001/20000000-0000-4000-8000-000000000001"
  },
  "relatedEvents": []
}

MITRE ATT&CK Mapping

Tactics: Defense Impairment

Techniques:
  • T1686.001 — Cloud Firewall — Adversaries may disable or modify a firewall within a cloud environment to bypass controls that limit access to cloud resources.
shares T1686.001 — Cloud Firewall
AuthorizeDBSecurityGroupIngress AuthorizeSecurityGroupEgress AuthorizeSecurityGroupIngress compute.firewalls.delete compute.firewalls.patch CreateNetworkAclEntry DeleteNetworkAcl DeleteNetworkAclEntry +1 more
same service (Azure - Network Security Group)
Microsoft.Network/networkSecurityGroups/securityRules/write