Azure Resource Group Deleted

AnalysisType: rule
Filename: azure_resource_group_deleted.py
RuleID: "Azure.MonitorActivity.ResourceGroup.Deleted"
DisplayName: "Azure Resource Group Deleted"
Enabled: true
LogTypes:
  - Azure.MonitorActivity
Severity: Medium
Description: >
  Detects when an Azure Resource Group is deleted.
  Resource group deletion removes all resources within the group and may indicate mass destruction or legitimate cleanup.
Reports:
  MITRE ATT&CK:
    - TA0040:T1485 # Impact: Data Destruction
Tags:
  - Impact
  - Data Destruction
Runbook: |
  1. Query Azure Monitor Activity logs for all resource operations by the callerIpAddress in the 24 hours before this alert to establish if this is part of a larger resource deletion pattern
  2. Check if the source IP is associated with known cloud providers, VPN services, or corporate network ranges using threat intelligence
  3. Search for other Azure resource deletions or destructive operations from the same user or IP in the past 7 days to assess the scope of potential impact
Reference: https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/delete-resource-group?tabs=azure-powershell
SummaryAttributes:
  - resourceId
  - callerIpAddress
  - correlationId
Tests:
  - Name: Resource Group Deleted
    ExpectedResult: true
    Log:
      {
        "time": "2024-12-17T10:30:00.0000000Z",
        "resourceId": "/subscriptions/12345678-1234-1234-1234-123456789abc/resourceGroups/myresourcegroup",
        "operationName": "Microsoft.Resources/subscriptions/resourceGroups/delete",
        "operationVersion": "2021-04-01",
        "category": "Administrative",
        "resultType": "Success",
        "resultSignature": "200",
        "callerIpAddress": "1.1.1.1",
        "correlationId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
        "location": "eastus",
        "tenantId": "87654321-4321-4321-4321-111111111111"
      }
  - Name: Case Insensitive Match
    ExpectedResult: true
    Log:
      {
        "time": "2024-12-17T11:45:00.0000000Z",
        "resourceId": "/subscriptions/12345678-1234-1234-1234-123456789abc/resourceGroups/prod-rg",
        "operationName": "microsoft.resources/subscriptions/resourcegroups/delete",
        "operationVersion": "2021-04-01",
        "category": "Administrative",
        "resultType": "Succeeded",
        "callerIpAddress": "1.2.3.4",
        "correlationId": "f9e8d7c6-b5a4-3210-9876-fedcba098765",
        "location": "eastus",
        "tenantId": "87654321-4321-4321-4321-111111111111"
      }
  - Name: Different Operation
    ExpectedResult: false
    Log:
      {
        "time": "2024-12-17T13:30:00.0000000Z",
        "resourceId": "/subscriptions/12345678-1234-1234-1234-123456789abc/resourceGroups/myresourcegroup",
        "operationName": "Microsoft.Resources/subscriptions/resourceGroups/write",
        "operationVersion": "2021-04-01",
        "category": "Administrative",
        "resultType": "Success",
        "callerIpAddress": "1.1.1.1",
        "correlationId": "d4e5f6a7-b8c9-0123-def0-234567890123",
        "location": "eastus",
        "tenantId": "87654321-4321-4321-4321-111111111111"
      }

# ------ paired body: azure_resource_group_deleted.py ------

from panther_azureactivity_helpers import (
    azure_activity_alert_context,
    azure_activity_success,
    extract_resource_name_from_id,
)

RESOURCE_GROUP_DELETE = "MICROSOFT.RESOURCES/SUBSCRIPTIONS/RESOURCEGROUPS/DELETE"


def rule(event):
    return event.get(
        "operationName", ""
    ).upper() == RESOURCE_GROUP_DELETE and azure_activity_success(event)


def title(event):
    resource_id = event.get("resourceId", "")
    resource_group = extract_resource_name_from_id(
        resource_id, "resourceGroups", default="<UNKNOWN_RESOURCE_GROUP>"
    )

    return f"Azure Resource Group [{resource_group}] deleted"


def alert_context(event):
    context = azure_activity_alert_context(event)

    resource_id = event.get("resourceId", "")

    resource_group_name = extract_resource_name_from_id(resource_id, "resourceGroups", default="")
    if resource_group_name:
        context["resource_group_name"] = resource_group_name

    return context