Data Source
AzureActivity
3 queries tagged with this data source.
-
Analytics Rules
Detect Diagnostic Deletion Then Tenant Activity Same Session
Enhanced log-suppression sequence detection that further requires the follow-on activity to share the same CallerIpAddress — same session, not just same identity.
-
Analytics Rules
Detect Diagnostic Deletion Then Tenant Activity Sequence
T1562.008 sequence: Azure diagnostic-setting deletion followed by any activity from the same Caller within 60 minutes.
-
Hunting
Hunt Azure Diagnostic Setting Deletions
Deletions of Azure diagnostic settings — the moment an attacker turns off logging (T1562.008). Step 1 of a two-step sequence.