Azure Virtual Network Deleted

AnalysisType: rule
Filename: azure_virtual_network_deleted.py
RuleID: "Azure.MonitorActivity.Network.VNetDeleted"
DisplayName: "Azure Virtual Network Deleted"
Enabled: true
LogTypes:
  - Azure.MonitorActivity
Severity: High
Description: >
  Detects when an Azure Virtual Network (VNet) is deleted.
  VNet deletion removes the entire network infrastructure and disconnects all resources within it, causing significant service disruption.
  This may indicate ransomware activity, sabotage, or unauthorized infrastructure destruction.
Reports:
  MITRE ATT&CK:
    - TA0040:T1485 # Impact: Data Destruction
    - TA0040:T1499 # Impact: Endpoint Denial of Service
Runbook: |
  1. Find all Azure Monitor Activity resource deletion operations by the callerIpAddress in the 24 hours before and after the alert to identify if multiple resources are being destroyed
  2. Query for Azure Monitor Activity events related to the deleted VNet resourceId in the 6 hours before deletion to identify connected resources and assess service impact
  3. Check if the callerIpAddress is associated with known VPN services or corporate IP ranges and compare to the caller's authentication patterns in the past 30 days
Reference: https://learn.microsoft.com/en-us/azure/virtual-network/manage-virtual-network
SummaryAttributes:
  - resourceId
  - callerIpAddress
  - correlationId
Tests:
  - Name: VNet Deleted Successfully
    ExpectedResult: true
    Log:
      {
        "time": "2024-12-17T10:30:00.0000000Z",
        "resourceId": "/subscriptions/12345678-1234-1234-1234-123456789abc/resourceGroups/myresourcegroup/providers/Microsoft.Network/virtualNetworks/myvnet",
        "operationName": "Microsoft.Network/virtualNetworks/delete",
        "operationVersion": "2021-04-01",
        "category": "Administrative",
        "resultType": "Success",
        "resultSignature": "200",
        "callerIpAddress": "1.1.1.1",
        "correlationId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
        "location": "",
        "tenantId": "87654321-4321-4321-4321-111111111111"
      }
  - Name: Case Insensitive Match
    ExpectedResult: true
    Log:
      {
        "time": "2024-12-17T11:45:00.0000000Z",
        "resourceId": "/subscriptions/12345678-1234-1234-1234-123456789abc/resourceGroups/prod-rg/providers/Microsoft.Network/virtualNetworks/prodvnet",
        "operationName": "microsoft.network/virtualnetworks/delete",
        "operationVersion": "2021-04-01",
        "category": "Administrative",
        "resultType": "Succeeded",
        "callerIpAddress": "1.2.3.4",
        "correlationId": "f9e8d7c6-b5a4-3210-9876-fedcba098765",
        "location": "eastus",
        "tenantId": "87654321-4321-4321-4321-111111111111"
      }
  - Name: Different Operation
    ExpectedResult: false
    Log:
      {
        "time": "2024-12-17T13:30:00.0000000Z",
        "resourceId": "/subscriptions/12345678-1234-1234-1234-123456789abc/resourceGroups/myresourcegroup/providers/Microsoft.Network/virtualNetworks/myvnet",
        "operationName": "Microsoft.Network/virtualNetworks/write",
        "operationVersion": "2021-04-01",
        "category": "Administrative",
        "resultType": "Success",
        "callerIpAddress": "203.0.113.75",
        "correlationId": "d4e5f6a7-b8c9-0123-def0-234567890123",
        "location": "westus",
        "tenantId": "87654321-4321-4321-4321-210987654321"
      }

# ------ paired body: azure_virtual_network_deleted.py ------

from panther_azureactivity_helpers import (
    azure_activity_alert_context,
    azure_activity_success,
    extract_resource_name_from_id,
)

VNET_DELETE = "MICROSOFT.NETWORK/VIRTUALNETWORKS/DELETE"


def rule(event):
    return event.get("operationName", "").upper() == VNET_DELETE and azure_activity_success(event)


def title(event):
    resource_id = event.get("resourceId", "")
    vnet = extract_resource_name_from_id(resource_id, "virtualNetworks", default="<UNKNOWN_VNET>")

    return f"Azure Virtual Network [{vnet}] deleted"


def alert_context(event):
    context = azure_activity_alert_context(event)

    resource_id = event.get("resourceId", "")

    vnet_name = extract_resource_name_from_id(resource_id, "virtualNetworks", default="")
    if vnet_name:
        context["vnet_name"] = vnet_name

    resource_group = extract_resource_name_from_id(resource_id, "resourceGroups", default="")
    if resource_group:
        context["resource_group"] = resource_group

    return context