Azure Network Watcher Deleted

AnalysisType: rule
Filename: azure_network_watcher_deleted.py
RuleID: "Azure.MonitorActivity.Network.WatcherDeleted"
DisplayName: "Azure Network Watcher Deleted"
Enabled: true
LogTypes:
  - Azure.MonitorActivity
Severity: Medium
Description: >
  Detects when an Azure Network Watcher is deleted. Network Watcher is a regional service that
  enables monitoring and diagnostics for network resources in Azure, including packet capture,
  connection monitoring, flow logging, and network performance diagnostics. Adversaries may
  delete Network Watchers to disable network visibility and evade detection during lateral
  movement, data exfiltration, or other network-based attacks.
Reports:
  MITRE ATT&CK:
    - TA0005:T1562.001 # Defense Evasion: Impair Defenses - Disable or Modify Tools
Tags:
  - Defense Evasion
  - Impair Defenses
  - Disable or Modify Tools
Runbook: |
  1. Query Azure Monitor Activity logs for all network monitoring operations (network watcher deletions, NSG flow log deletions, packet capture operations) by the callerIpAddress in the 24 hours before and after the alert
  2. Find all network watcher deletions and NSG flow log deletions in the past 6 hours to determine if this is part of a coordinated attack on network visibility
  3. Check if the callerIpAddress has deleted network monitoring resources in the past 90 days to establish if this is typical infrastructure maintenance
Reference: https://learn.microsoft.com/en-us/azure/network-watcher/network-watcher-overview
SummaryAttributes:
  - resourceId
  - location
  - callerIpAddress
  - correlationId
Tests:
  - Name: Network Watcher Deleted Successfully
    ExpectedResult: true
    Log:
      {
        "time": "2025-12-22T10:30:00.0000000Z",
        "resourceId": "/subscriptions/12345678-1234-1234-1234-123456789abc/resourceGroups/NetworkWatcherRG/providers/Microsoft.Network/networkWatchers/NetworkWatcher_eastus",
        "operationName": "MICROSOFT.NETWORK/NETWORKWATCHERS/DELETE",
        "operationVersion": "2021-05-01",
        "category": "Administrative",
        "resultType": "Success",
        "resultSignature": "200",
        "callerIpAddress": "1.1.1.1",
        "correlationId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
        "level": "Informational",
        "location": "eastus",
        "tenantId": "87654321-4321-4321-4321-111111111111"
      }
  - Name: Network Watcher Deleted Case Insensitive
    ExpectedResult: true
    Log:
      {
        "time": "2025-12-22T11:15:00.0000000Z",
        "resourceId": "/subscriptions/11111111-1111-1111-1111-111111111111/resourceGroups/NetworkWatcherRG/providers/Microsoft.Network/networkWatchers/NetworkWatcher_westeurope",
        "operationName": "microsoft.network/networkwatchers/delete",
        "category": "Administrative",
        "resultType": "Succeeded",
        "callerIpAddress": "2.2.2.2",
        "correlationId": "b2c3d4e5-f6a7-8901-bcde-f23456789012",
        "level": "Information",
        "location": "westeurope",
        "tenantId": "22222222-2222-2222-2222-222222222222"
      }
  - Name: Different Resource
    ExpectedResult: false
    Log:
      {
        "time": "2025-12-22T14:00:00.0000000Z",
        "resourceId": "/subscriptions/55555555-5555-5555-5555-555555555555/resourceGroups/network-rg/providers/Microsoft.Network/virtualNetworks/myvnet",
        "operationName": "MICROSOFT.NETWORK/VIRTUALNETWORKS/DELETE",
        "category": "Administrative",
        "resultType": "Success",
        "callerIpAddress": "5.5.5.5",
        "correlationId": "e5f6a7b8-c9d0-1234-ef01-567890123456",
        "tenantId": "55555555-5555-5555-5555-555555555555"
      }