Skip to content
TheCloud.Events

Microsoft.Storage/storageAccounts/blobServices/containers/delete

Azure

Microsoft.Storage/storageAccounts/blobServices/containers/delete

service: Azure - Azure Storage
tactics:
Impact
techniques:
T1485
tags:
Azure Azure Storage

Event

Permanently deletes a blob container from an Azure Storage account.

Security Context

  • Destructive deletion of cloud resources can cause significant operational disruption, data loss, and extended recovery times.

Log Source

Azure Activity Log

Sample Event

Adversarial. draco@fantasticlogs.cloud deletes the blob container customers from the production storage account flcoccamy001, destroying the customer dataset that fed downstream analytics. Container delete via the management plane fires this Activity Log event (separate from the data-plane DeleteContainer Storage Analytics log).

{
  "authorization": {
    "action": "Microsoft.Storage/storageAccounts/blobServices/containers/delete",
    "scope": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-occamy-pipeline/providers/Microsoft.Storage/storageAccounts/flcoccamy001/blobServices/default/containers/customers"
  },
  "caller": "draco@fantasticlogs.cloud",
  "channels": "Operation",
  "claims": {
    "appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
    "ipaddr": "203.0.113.66",
    "name": "Draco Malfoy",
    "http://schemas.microsoft.com/identity/claims/objectidentifier": "30000000-0000-4000-8000-001010011010",
    "puid": "1003200000000666",
    "http://schemas.microsoft.com/identity/claims/tenantid": "10000000-0000-4000-8000-000000000001",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "draco@fantasticlogs.cloud",
    "http://schemas.microsoft.com/identity/claims/wids": "e8611ab8-c189-46e8-94e1-60213ab1f814",
    "uti": "ctnrDel222ExampleUti",
    "ver": "1.0"
  },
  "correlationId": "90000000-0000-4000-8000-000100010010",
  "description": "",
  "eventDataId": "90000000-0000-4000-8000-000100010011",
  "eventName": {
    "value": "EndRequest",
    "localizedValue": "End request"
  },
  "category": {
    "value": "Administrative",
    "localizedValue": "Administrative"
  },
  "eventTimestamp": "2026-04-15T18:51:14.4218812Z",
  "id": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-occamy-pipeline/providers/Microsoft.Storage/storageAccounts/flcoccamy001/blobServices/default/containers/customers/events/90000000-0000-4000-8000-000100010011/ticks/638798264744218812",
  "level": "Informational",
  "operationId": "90000000-0000-4000-8000-000100110110",
  "operationName": {
    "value": "Microsoft.Storage/storageAccounts/blobServices/containers/delete",
    "localizedValue": "Delete Blob Container"
  },
  "resourceGroupName": "rg-occamy-pipeline",
  "resourceProviderName": {
    "value": "Microsoft.Storage",
    "localizedValue": "Microsoft.Storage"
  },
  "resourceType": {
    "value": "Microsoft.Storage/storageAccounts/blobServices/containers",
    "localizedValue": "Microsoft.Storage/storageAccounts/blobServices/containers"
  },
  "resourceId": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-occamy-pipeline/providers/Microsoft.Storage/storageAccounts/flcoccamy001/blobServices/default/containers/customers",
  "status": {
    "value": "Succeeded",
    "localizedValue": "Succeeded"
  },
  "subStatus": {
    "value": "OK",
    "localizedValue": "OK (HTTP Status Code: 200)"
  },
  "submissionTimestamp": "2026-04-15T18:51:15.0298128Z",
  "subscriptionId": "20000000-0000-4000-8000-000000000001",
  "tenantId": "10000000-0000-4000-8000-000000000001",
  "properties": {
    "statusCode": "OK",
    "serviceRequestId": null,
    "eventCategory": "Administrative",
    "entity": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-occamy-pipeline/providers/Microsoft.Storage/storageAccounts/flcoccamy001/blobServices/default/containers/customers",
    "message": "Microsoft.Storage/storageAccounts/blobServices/containers/delete",
    "hierarchy": "10000000-0000-4000-8000-000000000001/20000000-0000-4000-8000-000000000001"
  },
  "relatedEvents": []
}

MITRE ATT&CK Mapping

Tactics: Impact

Techniques:
  • T1485 — Data Destruction — Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and r...
shares T1485 — Data Destruction
DeleteBucket DeleteDBCluster DeleteDBInstance DeleteFileSystem DeleteGlobalCluster DeleteObject DeleteObjects DeleteSnapshot +17 more
same service (Azure - Azure Storage)
Microsoft.Storage/storageAccounts/delete Microsoft.Storage/storageAccounts/listKeys/action Microsoft.Storage/storageAccounts/regenerateKey/action Microsoft.Storage/storageAccounts/stopLogging/action