Azure Recovery Services Protection Container Deleted

Description

Detects deletion of Azure Recovery Services protection containers containing VM and workload backups. Storm-0501 systematically deletes backup containers before deploying ransomware to prevent recovery. This operation permanently destroys all recovery points for protected resources.

Query · python

from panther_azureactivity_helpers import (
    azure_activity_alert_context,
    azure_activity_success,
    extract_resource_name_from_id,
)

PROTECTION_CONTAINER_DELETE = (
    "MICROSOFT.RECOVERYSERVICES/VAULTS/BACKUPFABRICS/PROTECTIONCONTAINERS/DELETE"
)


def rule(event):
    return event.get(
        "operationName", ""
    ).upper() == PROTECTION_CONTAINER_DELETE and azure_activity_success(event)


def title(event):
    resource_id = event.get("resourceId", "")
    vault_name = extract_resource_name_from_id(resource_id, "vaults", default="<UNKNOWN_VAULT>")
    container_name = extract_resource_name_from_id(
        resource_id, "protectionContainers", default="<UNKNOWN_CONTAINER>"
    )

    return (
        f"Azure Recovery Services protection container [{container_name}] "
        f"deleted from vault [{vault_name}]"
    )


def alert_context(event):
    context = azure_activity_alert_context(event)

    resource_id = event.get("resourceId", "")

    vault_name = extract_resource_name_from_id(resource_id, "vaults", default="")
    if vault_name:
        context["vault_name"] = vault_name

    container_name = extract_resource_name_from_id(resource_id, "protectionContainers", default="")
    if container_name:
        context["protection_container"] = container_name

    fabric_name = extract_resource_name_from_id(resource_id, "backupFabrics", default="")
    if fabric_name:
        context["backup_fabric"] = fabric_name

    resource_group = extract_resource_name_from_id(resource_id, "resourceGroups", default="")
    if resource_group:
        context["resource_group"] = resource_group

    return context

Analyst notes

Query Azure Monitor Activity logs for all protection container deletions by the callerIpAddress in the past 6 hours to calculate the total number of backup containers destroyed
Search for resource lock deletions on the same vault by the same caller in the 6 hours before this deletion to identify Storm-0501 attack pattern
Find all role assignment operations for the caller identity in the 48 hours before deletion to identify if Owner or Backup Operator permissions were recently granted
Check Azure.Audit logs for authentication events from the callerIpAddress in the 48-72 hours before to identify account compromise indicators
Search for other backup destruction or ransomware-related alerts triggered by the same callerIpAddress across all subscriptions in the past 7 days

Detection tier

Atomic IOCs
Network & Host Artifacts
Tools
TTPs
Pending classification

Metadata

Source: panther-labs/panther-analysis
License: Apache 2.0
Severity: High
Status: Stable
Query type: python
Created: 2026-02-04
Modified: 2026-04-07
Authored by: panther-labs
Source ID
Upstream: rules/azure_activity_rules/azure_recovery_services_container_deleted.yml
Type: rule
Version: 2
References: https://www.microsoft.com/en-us/security/blog/2025/08/27/storm-0501s-evolving-techniques-lead-to-cloud-based-ransomware/
Data sources: Azure.MonitorActivity

ATT&CK

TA0005TA0040 T1485 T1490 T1562