Azure Network Watcher Deleted
Description
Detects when an Azure Network Watcher is deleted. Network Watcher is a regional service that enables monitoring and diagnostics for network resources in Azure, including packet capture, connection monitoring, flow logging, and network performance diagnostics. Adversaries may delete Network Watchers to disable network visibility and evade detection during lateral movement, data exfiltration, or other network-based attacks.
Query · python
from panther_azureactivity_helpers import (
azure_activity_alert_context,
azure_activity_success,
extract_resource_name_from_id,
)
NETWORK_WATCHER_DELETE_OPERATION = "MICROSOFT.NETWORK/NETWORKWATCHERS/DELETE"
def rule(event):
return all(
[
event.get("operationName", "").upper() == NETWORK_WATCHER_DELETE_OPERATION,
azure_activity_success(event),
]
)
def title(event):
resource_id = event.get("resourceId", "")
network_watcher = extract_resource_name_from_id(
resource_id, "networkWatchers", default="<UNKNOWN_WATCHER>"
)
return f"Azure Network Watcher [{network_watcher}] Deleted"
def alert_context(event):
context = azure_activity_alert_context(event)
resource_id = event.get("resourceId", "")
network_watcher_name = extract_resource_name_from_id(resource_id, "networkWatchers", default="")
if network_watcher_name:
context["network_watcher_name"] = network_watcher_name
resource_group = extract_resource_name_from_id(resource_id, "resourceGroups", default="")
if resource_group:
context["resource_group"] = resource_group
return context
Analyst notes
- Query Azure Monitor Activity logs for all network monitoring operations (network watcher deletions, NSG flow log deletions, packet capture operations) by the callerIpAddress in the 24 hours before and after the alert
- Find all network watcher deletions and NSG flow log deletions in the past 6 hours to determine if this is part of a coordinated attack on network visibility
- Check if the callerIpAddress has deleted network monitoring resources in the past 90 days to establish if this is typical infrastructure maintenance