Microsoft.Security/securitySolutions/delete
Azure
Microsoft.Security/securitySolutions/delete
Event
Removes a security solution integrated with Microsoft Defender for Cloud.
Security Context
- Impairing defenses allows adversaries to operate freely by removing security controls that would otherwise detect or block their activity.
- Tampering with cloud security services blinds defenders to threats and may indicate an adversary is preparing for further malicious activity.
Log Source
Azure Activity Log
Sample Event
Adversarial. draco@fantasticlogs.cloud deletes the registered third-party security solution niffler-edr-integration (representing a third-party EDR / vulnerability-scanner integration) from Defender for Cloud, removing its alerts from the Defender alert stream.
{ "authorization": { "action": "Microsoft.Security/securitySolutions/delete", "scope": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-fantasticlogs-prod/providers/Microsoft.Security/securitySolutions/niffler-edr-integration" }, "caller": "draco@fantasticlogs.cloud", "channels": "Operation", "claims": { "appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46", "ipaddr": "203.0.113.66", "name": "Draco Malfoy", "http://schemas.microsoft.com/identity/claims/objectidentifier": "30000000-0000-4000-8000-001010011010", "puid": "1003200000000666", "http://schemas.microsoft.com/identity/claims/tenantid": "10000000-0000-4000-8000-000000000001", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "draco@fantasticlogs.cloud", "http://schemas.microsoft.com/identity/claims/wids": "e8611ab8-c189-46e8-94e1-60213ab1f814", "uti": "secSolDel216ExampleUti", "ver": "1.0" }, "correlationId": "90000000-0000-4000-8000-000100101101", "description": "", "eventDataId": "90000000-0000-4000-8000-000100101110", "eventName": { "value": "EndRequest", "localizedValue": "End request" }, "category": { "value": "Administrative", "localizedValue": "Administrative" }, "eventTimestamp": "2026-04-15T17:34:11.7218104Z", "id": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-fantasticlogs-prod/providers/Microsoft.Security/securitySolutions/niffler-edr-integration/events/90000000-0000-4000-8000-000100101110/ticks/638798199517218104", "level": "Informational", "operationId": "90000000-0000-4000-8000-000100101111", "operationName": { "value": "Microsoft.Security/securitySolutions/delete", "localizedValue": "Delete Security Solution" }, "resourceGroupName": "rg-fantasticlogs-prod", "resourceProviderName": { "value": "Microsoft.Security", "localizedValue": "Microsoft.Security" }, "resourceType": { "value": "Microsoft.Security/securitySolutions", "localizedValue": "Microsoft.Security/securitySolutions" }, "resourceId": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-fantasticlogs-prod/providers/Microsoft.Security/securitySolutions/niffler-edr-integration", "status": { "value": "Succeeded", "localizedValue": "Succeeded" }, "subStatus": { "value": "OK", "localizedValue": "OK (HTTP Status Code: 200)" }, "submissionTimestamp": "2026-04-15T17:34:12.2702118Z", "subscriptionId": "20000000-0000-4000-8000-000000000001", "tenantId": "10000000-0000-4000-8000-000000000001", "properties": { "statusCode": "OK", "serviceRequestId": null, "eventCategory": "Administrative", "entity": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-fantasticlogs-prod/providers/Microsoft.Security/securitySolutions/niffler-edr-integration", "message": "Microsoft.Security/securitySolutions/delete", "hierarchy": "10000000-0000-4000-8000-000000000001/20000000-0000-4000-8000-000000000001" }, "relatedEvents": []}MITRE ATT&CK Mapping
Tactics: Defense Impairment
Techniques:
- T1685 — Disable or Modify Tools — Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities. This may include stopping spec...