Azure VM Snapshot Deleted

AnalysisType: rule
Filename: azure_vm_snapshot_deleted.py
RuleID: "Azure.MonitorActivity.Compute.SnapshotDeleted"
DisplayName: "Azure VM Snapshot Deleted"
Enabled: true
LogTypes:
  - Azure.MonitorActivity
Severity: Low
Description: >
  Detects when an Azure disk snapshot is deleted. Snapshots serve critical functions for backup,
  disaster recovery, and forensic analysis. Adversaries may target snapshots to prevent data
  recovery, destroy forensic evidence, or undermine backup strategies before launching ransomware
  or destructive operations.
Reports:
  MITRE ATT&CK:
    - TA0040:T1485 # Impact: Data Destruction
    - TA0040:T1490 # Impact: Inhibit System Recovery
Tags:
  - Impact
  - Data Destruction
  - Inhibit System Recovery
  - Ransomware
Runbook: |
  1. Query Azure Monitor Activity logs for all backup and recovery operations (snapshot deletions, restore point deletions, disk deletions) by the callerIpAddress in the 24 hours before and after the alert
  2. Find all snapshot deletions across all subscriptions in the past 6 hours to determine if this is part of a pre-ransomware attack pattern
  3. Check if the callerIpAddress has deleted snapshots in the past 90 days to establish if this is normal maintenance activity
Reference: https://github.com/elastic/detection-rules/blob/main/rules/integrations/azure/impact_azure_compute_vm_snapshot_deletion.toml
SummaryAttributes:
  - resourceId
  - callerIpAddress
  - correlationId
Tests:
  - Name: VM Snapshot Deleted Successfully
    ExpectedResult: true
    Log:
      {
        "time": "2025-12-22T10:30:00.0000000Z",
        "resourceId": "/subscriptions/12345678-1234-1234-1234-123456789abc/resourceGroups/backup-rg/providers/Microsoft.Compute/snapshots/vm-backup-snapshot-20251222",
        "operationName": "MICROSOFT.COMPUTE/SNAPSHOTS/DELETE",
        "operationVersion": "2021-12-01",
        "category": "Administrative",
        "resultType": "Success",
        "resultSignature": "200",
        "callerIpAddress": "1.1.1.1",
        "correlationId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
        "level": "Informational",
        "location": "eastus",
        "tenantId": "87654321-4321-4321-4321-111111111111"
      }
  - Name: Snapshot Deleted Case Insensitive
    ExpectedResult: true
    Log:
      {
        "time": "2025-12-22T11:15:00.0000000Z",
        "resourceId": "/subscriptions/11111111-1111-1111-1111-111111111111/resourceGroups/prod-backups/providers/Microsoft.Compute/snapshots/prod-snapshot-001",
        "operationName": "microsoft.compute/snapshots/delete",
        "category": "Administrative",
        "resultType": "Succeeded",
        "callerIpAddress": "2.2.2.2",
        "correlationId": "b2c3d4e5-f6a7-8901-bcde-f23456789012",
        "level": "Information",
        "location": "westeurope",
        "tenantId": "22222222-2222-2222-2222-222222222222"
      }
  - Name: Different Operation
    ExpectedResult: false
    Log:
      {
        "time": "2025-12-22T13:00:00.0000000Z",
        "resourceId": "/subscriptions/44444444-4444-4444-4444-444444444444/resourceGroups/backup-rg/providers/Microsoft.Compute/snapshots/new-snapshot",
        "operationName": "MICROSOFT.COMPUTE/SNAPSHOTS/WRITE",
        "category": "Administrative",
        "resultType": "Success",
        "callerIpAddress": "4.4.4.4",
        "correlationId": "d4e5f6a7-b8c9-0123-def0-456789012345",
        "tenantId": "44444444-4444-4444-4444-444444444444"
      }

# ------ paired body: azure_vm_snapshot_deleted.py ------

from panther_azureactivity_helpers import (
    azure_activity_alert_context,
    azure_activity_success,
    extract_resource_name_from_id,
)

SNAPSHOT_DELETE = "MICROSOFT.COMPUTE/SNAPSHOTS/DELETE"


def rule(event):
    return event.get("operationName", "").upper() == SNAPSHOT_DELETE and azure_activity_success(
        event
    )


def title(event):
    resource_id = event.get("resourceId", "")
    snapshot_name = extract_resource_name_from_id(
        resource_id, "snapshots", default="<UNKNOWN_SNAPSHOT>"
    )

    return f"Azure VM Snapshot [{snapshot_name}] deleted"


def alert_context(event):
    context = azure_activity_alert_context(event)

    resource_id = event.get("resourceId", "")

    snapshot_name = extract_resource_name_from_id(resource_id, "snapshots", default="")
    if snapshot_name:
        context["snapshot_name"] = snapshot_name

    resource_group = extract_resource_name_from_id(resource_id, "resourceGroups", default="")
    if resource_group:
        context["resource_group"] = resource_group

    return context