Azure Event Hub Deleted

AnalysisType: rule
Filename: azure_event_hub_deleted.py
RuleID: "Azure.MonitorActivity.EventHub.Deleted"
DisplayName: "Azure Event Hub Deleted"
Enabled: true
LogTypes:
  - Azure.MonitorActivity
Severity: High
Description: >
  Detects when an Azure Event Hub is deleted. Event Hubs are critical event processing services
  that ingest and process large volumes of data for log collection, SIEM ingestion, and real-time
  analytics. Adversaries may delete Event Hubs to evade detection by disrupting data flows and
  erasing evidence of their malicious activities. Deletion of Event Hubs used for security logging
  can blind security teams to ongoing attacks.
Reports:
  MITRE ATT&CK:
    - TA0005:T1562.008 # Defense Evasion: Impair Defenses - Disable or Modify Cloud Logs
Tags:
  - Defense Evasion
  - Impair Defenses
  - Disable Cloud Logs
Runbook: |
  1. Query Azure Monitor Activity logs for all logging infrastructure operations (event hub deletions, diagnostic settings deletions, log analytics workspace deletions) by the callerIpAddress in the 24 hours before and after the alert
  2. Find all event hub deletions in the past 6 hours to determine if this is part of a coordinated attack on security logging infrastructure
  3. Check if the callerIpAddress has deleted event hubs in the past 90 days to establish if this is typical infrastructure management activity
Reference: https://learn.microsoft.com/en-us/azure/event-hubs/event-hubs-about
SummaryAttributes:
  - resourceId
  - callerIpAddress
  - correlationId
Tests:
  - Name: Event Hub Deleted Successfully
    ExpectedResult: true
    Log:
      {
        "time": "2025-12-22T10:30:00.0000000Z",
        "resourceId": "/subscriptions/12345678-1234-1234-1234-123456789abc/resourceGroups/logging-rg/providers/Microsoft.EventHub/namespaces/security-logs-hub/eventhubs/siem-events",
        "operationName": "MICROSOFT.EVENTHUB/NAMESPACES/EVENTHUBS/DELETE",
        "operationVersion": "2021-11-01",
        "category": "Administrative",
        "resultType": "Success",
        "resultSignature": "200",
        "callerIpAddress": "1.1.1.1",
        "correlationId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
        "level": "Informational",
        "location": "eastus",
        "tenantId": "87654321-4321-4321-4321-111111111111"
      }
  - Name: Event Hub Deleted Case Insensitive
    ExpectedResult: true
    Log:
      {
        "time": "2025-12-22T11:15:00.0000000Z",
        "resourceId": "/subscriptions/11111111-1111-1111-1111-111111111111/resourceGroups/prod-logging/providers/Microsoft.EventHub/namespaces/prod-hub/eventhubs/audit-logs",
        "operationName": "microsoft.eventhub/namespaces/eventhubs/delete",
        "category": "Administrative",
        "resultType": "Succeeded",
        "callerIpAddress": "2.2.2.2",
        "correlationId": "b2c3d4e5-f6a7-8901-bcde-f23456789012",
        "level": "Information",
        "location": "westeurope",
        "tenantId": "22222222-2222-2222-2222-222222222222"
      }
  - Name: Different Resource Type
    ExpectedResult: false
    Log:
      {
        "time": "2025-12-22T14:00:00.0000000Z",
        "resourceId": "/subscriptions/55555555-5555-5555-5555-555555555555/resourceGroups/storage-rg/providers/Microsoft.Storage/storageAccounts/mystorageaccount",
        "operationName": "MICROSOFT.STORAGE/STORAGEACCOUNTS/DELETE",
        "category": "Administrative",
        "resultType": "Success",
        "callerIpAddress": "5.5.5.5",
        "correlationId": "e5f6a7b8-c9d0-1234-ef01-567890123456",
        "tenantId": "55555555-5555-5555-5555-555555555555"
      }