Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

Azure Storage Account Deletion by Unusual User

Identifies when an Azure Storage Account is deleted. Adversaries may delete storage accounts to disrupt operations, destroy evidence, or cause denial of service. This activity could indicate an attacker attempting to cover their tracks after data exfiltration or as part of a destructive attack. Monitoring storage account deletions is critical for detecting potential impact on business operations and data availability.

ATT&CK coverage

Impact

Detection requirements

Log source category: event_index

What the source says

What fires this without an attack behind it

Storage administrators may legitimately delete storage accounts during decommissioning, resource cleanup, or infrastructure optimization. Verify that the deletion was expected and follows organizational change management processes. Consider exceptions for approved maintenance windows.

References

https://www.microsoft.com/en-us/security/blog/2025/08/27/storm-0501s-evolving-techniques-lead-to-cloud-based-ransomware/

Tagged by the source as

Data Source: AzureData Source: Azure Activity LogsDomain: CloudDomain: StorageResources: Investigation GuideTactic: ImpactUse Case: Threat Detection

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.