[New Rule] Azure Network Watcher Deletion

[bm11100]

Description

Identifies the deletion of a Network Watcher in Azure. Network Watcher is used to monitor, diagnose, view metrics, and enable or disable logs for resources in an Azure virtual network. An adversary may delete a network watcher in an attempt to evade defenses.

Required Info

• Eventing Sources:
  filebeat-*

• Platforms
  azure

• Target ECS Version: 1.5.0

• New fields required in ECS for this?

• Related issues or PRs

Optional Info

• References:
  https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-monitoring-overview

Syntax

event.module:azure and event.dataset:azure.activitylogs and event.category:Administrative and azure.activitylogs.operation_name:MICROSOFT.NETWORK/NETWORKWATCHERS/DELETE and event.outcome:Success

Example Data