Azure Disk Deleted

AnalysisType: rule
Filename: azure_disk_deleted.py
RuleID: "Azure.MonitorActivity.Compute.DiskDeleted"
DisplayName: "Azure Disk Deleted"
Enabled: true
LogTypes:
  - Azure.MonitorActivity
Severity: Info
Status: Experimental
Description: >
  Detects when an Azure managed disk is deleted.
  Unauthorized disk deletion can indicate ransomware activity where attackers destroy data or delete backup disks to prevent recovery.
  This may also indicate legitimate cleanup operations.
Reports:
  MITRE ATT&CK:
    - TA0040:T1485 # Impact: Data Destruction
    - TA0040:T1490 # Impact: Inhibit System Recovery
Tags:
  - Impact
  - Data Destruction
  - Inhibit System Recovery
  - Ransomware
Runbook: |
  1. Query Azure Monitor Activity logs for all disk operations by the callerIpAddress in the 24 hours before and after the alert to identify if multiple disks are being deleted in sequence
  2. Find all compute resource deletion events from the same caller in the past 7 days to assess if this is part of a broader data destruction pattern
  3. Check if the source IP matches known VPN ranges or corporate network addresses associated with authorized administrators
Reference: https://learn.microsoft.com/en-us/rest/api/compute/disks/delete?view=rest-compute-2025-04-01#:~:text=Deletes%20a%20disk.,version=2025-01-02
SummaryAttributes:
  - resourceId
  - callerIpAddress
  - correlationId
Tests:
  - Name: Disk Deleted Successfully
    ExpectedResult: true
    Log:
      {
        "time": "2024-12-17T10:30:00.0000000Z",
        "resourceId": "/subscriptions/12345678-1234-1234-1234-123456789abc/resourceGroups/myresourcegroup/providers/Microsoft.Compute/disks/mydisk",
        "operationName": "Microsoft.Compute/disks/delete",
        "operationVersion": "2021-04-01",
        "category": "Administrative",
        "resultType": "Success",
        "resultSignature": "200",
        "callerIpAddress": "1.1.1.1",
        "correlationId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",

        "location": "eastus",
        "tenantId": "87654321-4321-4321-4321-111111111111"
      }
  - Name: Case Insensitive Match
    ExpectedResult: true
    Log:
      {
        "time": "2024-12-17T11:45:00.0000000Z",
        "resourceId": "/subscriptions/12345678-1234-1234-1234-123456789abc/resourceGroups/prod-rg/providers/Microsoft.Compute/disks/proddisk",
        "operationName": "microsoft.compute/disks/delete",
        "operationVersion": "2021-04-01",
        "category": "Administrative",
        "resultType": "Succeeded",
        "callerIpAddress": "1.2.3.4",
        "correlationId": "f9e8d7c6-b5a4-3210-9876-fedcba098765",

        "location": "westus",
        "tenantId": "87654321-4321-4321-4321-111111111111"
      }
  - Name: Different Operation
    ExpectedResult: false
    Log:
      {
        "time": "2024-12-17T13:30:00.0000000Z",
        "resourceId": "/subscriptions/12345678-1234-1234-1234-123456789abc/resourceGroups/myresourcegroup/providers/Microsoft.Compute/disks/mydisk",
        "operationName": "Microsoft.Compute/disks/write",
        "operationVersion": "2021-04-01",
        "category": "Administrative",
        "resultType": "Success",
        "callerIpAddress": "203.0.113.75",
        "correlationId": "d4e5f6a7-b8c9-0123-def0-234567890123",

        "location": "centralus",
        "tenantId": "87654321-4321-4321-4321-210987654321"
      }

# ------ paired body: azure_disk_deleted.py ------

from panther_azureactivity_helpers import (
    azure_activity_alert_context,
    azure_activity_success,
    extract_resource_name_from_id,
)

DISK_DELETE = "MICROSOFT.COMPUTE/DISKS/DELETE"


def rule(event):
    return event.get("operationName", "").upper() == DISK_DELETE and azure_activity_success(event)


def title(event):
    resource_id = event.get("resourceId", "")
    disk = extract_resource_name_from_id(resource_id, "disks", default="<UNKNOWN_DISK>")

    return f"Azure disk deleted [{disk}]"


def alert_context(event):
    context = azure_activity_alert_context(event)

    resource_id = event.get("resourceId", "")

    disk_name = extract_resource_name_from_id(resource_id, "disks", default="")
    if disk_name:
        context["disk_name"] = disk_name

    resource_group = extract_resource_name_from_id(resource_id, "resourceGroups", default="")
    if resource_group:
        context["resource_group"] = resource_group

    return context