Microsoft.OperationalInsights/workspaces/delete

CSP: Azure

Tactics:

Defense Evasion Impact

Techniques:

T1562.008T1485

Tags:

Azure Log Analytics

Event

Permanently deletes a Log Analytics workspace and its stored data.

Security Context

• Deleting or modifying audit logs destroys forensic evidence and prevents security teams from reconstructing the attack timeline.
• Destructive deletion of cloud resources can cause significant operational disruption, data loss, and extended recovery times.

Log Source

Azure Activity Log

Sample Event

MITRE ATT&CK Mapping

Tactics: Defense Evasion Impact

Techniques:

• T1562.008 — Disable or Modify Cloud Logs — An adversary may disable or modify cloud logging capabilities and integrations to limit what data is collected on their activities and avoid detection. Cloud environments allow for collection and analysis of audit and application logs that provide insight into what activities a user does within t...
• T1485 — Data Destruction — Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and r...