Azure Event Hub Deleted
Description
Detects when an Azure Event Hub is deleted. Event Hubs are critical event processing services that ingest and process large volumes of data for log collection, SIEM ingestion, and real-time analytics. Adversaries may delete Event Hubs to evade detection by disrupting data flows and erasing evidence of their malicious activities. Deletion of Event Hubs used for security logging can blind security teams to ongoing attacks.
Query · python
from panther_azureactivity_helpers import (
azure_activity_alert_context,
azure_activity_success,
extract_resource_name_from_id,
)
EVENT_HUB_DELETE_OPERATION = "MICROSOFT.EVENTHUB/NAMESPACES/EVENTHUBS/DELETE"
def rule(event):
return all(
[
event.get("operationName", "").upper() == EVENT_HUB_DELETE_OPERATION,
azure_activity_success(event),
]
)
def title(event):
resource_id = event.get("resourceId", "")
eventhub = extract_resource_name_from_id(resource_id, "eventhubs", default="<UNKNOWN_EVENTHUB>")
return f"Azure Event Hub Deleted: [{eventhub}]"
def alert_context(event):
context = azure_activity_alert_context(event)
resource_id = event.get("resourceId", "")
eventhub_name = extract_resource_name_from_id(resource_id, "eventhubs", default="")
if eventhub_name:
context["eventhub_name"] = eventhub_name
namespace_name = extract_resource_name_from_id(resource_id, "namespaces", default="")
if namespace_name:
context["namespace_name"] = namespace_name
resource_group = extract_resource_name_from_id(resource_id, "resourceGroups", default="")
if resource_group:
context["resource_group"] = resource_group
return context
Analyst notes
- Query Azure Monitor Activity logs for all logging infrastructure operations (event hub deletions, diagnostic settings deletions, log analytics workspace deletions) by the callerIpAddress in the 24 hours before and after the alert
- Find all event hub deletions in the past 6 hours to determine if this is part of a coordinated attack on security logging infrastructure
- Check if the callerIpAddress has deleted event hubs in the past 90 days to establish if this is typical infrastructure management activity