rage.fail

azure-defender-delete-suppression-rule

explicit azure emits CanDelete

match (effective permission)

{ "action": "Microsoft.Security/alertsSuppressionRules/delete", "scope_type": "subscription" }

emit

source type	`Identity`
target type	`SecurityService`
source	`<principal>`
target	`<Defender alert suppression rule node (SecurityService)>`
permissions	`Microsoft.Security/alertsSuppressionRules/delete`

Narrative

{principal.name} can delete Defender alert suppression rules for the subscription (Microsoft.Security/alertsSuppressionRules/delete). Deleting suppression rules removes existing alert muting, re-enabling previously-suppressed alert types - useful for a defender to undo attacker-created suppression rules, or for an attacker to clean up traces of suppression they created.

Raw rule rules/explicit/azure-defender.yaml

id: azure-defender-delete-suppression-rule
emits: CanDelete
applies_to:
- azure
match_effective_permission:
  action: Microsoft.Security/alertsSuppressionRules/delete
  scope_type: subscription
emit:
  source_type: Identity
  target_type: SecurityService
  source: <principal>
  target: <Defender alert suppression rule node (SecurityService)>
  permissions:
  - Microsoft.Security/alertsSuppressionRules/delete
  narrative: "{principal.name} can delete Defender alert suppression rules for the subscription (Microsoft.Security/alertsSuppressionRules/delete).\
    \ Deleting suppression rules removes existing alert muting, re-enabling previously-suppressed alert\
    \ types \u2014 useful for a defender to undo attacker-created suppression rules, or for an attacker\
    \ to clean up traces of suppression they created."