azure-monitor-delete-diagnostic-setting

Delete a diagnostic setting on an Azure resource or at subscription scope, stopping export of that resource's (or subscription's) Activity Log and resource logs to a Log Analytics workspace, storage account, or Event Hub. Headline defense-evasion primitive: subsequent attacker API activity goes unrecorded in the monitored scope.

derived azure emits CanDelete

match (effective permission)

{ "action": "Microsoft.Insights/diagnosticSettings/delete", "scope_type": "resource|resourceGroup|subscription" }

emit

source type	`Identity`
target type	`LoggingService`
source	`<principal>`
target	`<diagnostic setting (LoggingService node)>`
permissions	`Microsoft.Insights/diagnosticSettings/delete`
conditions	`iam_permission` `deny_assignment`
state logic	ACTIVE when the principal holds Microsoft.Insights/diagnosticSettings/delete at the effective scope of the target diagnostic setting with no deny assignment blocking it. Subscription-scope diagnostic settings require the delete permission at subscription scope; resource-scope settings require it at the resource or enclosing resource-group/subscription scope. BLOCKED if a deny assignment covers diagnosticSettings/delete at the effective scope. Diagnostic settings on resources in locked resource groups (CanNotDelete lock) are BLOCKED — the ARM lock prevents deletion even if the RBAC action is present. Note: deleting a subscription-scope diagnostic setting silences Activity Log export for the entire subscription — annotate is_subscription_scope=true settings with elevated blast radius.

Narrative

{principal.name} can delete the diagnostic setting {target.name} (Microsoft.Insights/diagnosticSettings/delete), stopping all export of resource logs and activity events from the monitored scope to the configured destination (Log Analytics workspace, storage account, or Event Hub). While the setting is absent, subsequent attacker actions in that scope go unrecorded. This is a cover-tracks / weaken-detective-controls primitive that grants no resource access.

Raw rule rules/derived/azure/monitor.yaml

id: azure-monitor-delete-diagnostic-setting
emits: CanDelete
description: 'Delete a diagnostic setting on an Azure resource or at subscription scope, stopping export
  of that resource''s (or subscription''s) Activity Log and resource logs to a Log Analytics workspace,
  storage account, or Event Hub. Headline defense-evasion primitive: subsequent attacker API activity
  goes unrecorded in the monitored scope.'
match_effective_permission:
  action: Microsoft.Insights/diagnosticSettings/delete
  scope_type: resource|resourceGroup|subscription
emit:
  source_type: Identity
  target_type: LoggingService
  source: <principal>
  target: <diagnostic setting (LoggingService node)>
  permissions:
  - Microsoft.Insights/diagnosticSettings/delete
  conditions:
  - iam_permission
  - deny_assignment
  state_logic: "ACTIVE when the principal holds Microsoft.Insights/diagnosticSettings/delete at the effective\
    \ scope of the target diagnostic setting with no deny assignment blocking it. Subscription-scope diagnostic\
    \ settings require the delete permission at subscription scope; resource-scope settings require it\
    \ at the resource or enclosing resource-group/subscription scope. BLOCKED if a deny assignment covers\
    \ diagnosticSettings/delete at the effective scope. Diagnostic settings on resources in locked resource\
    \ groups (CanNotDelete lock) are BLOCKED \u2014 the ARM lock prevents deletion even if the RBAC action\
    \ is present. Note: deleting a subscription-scope diagnostic setting silences Activity Log export\
    \ for the entire subscription \u2014 annotate is_subscription_scope=true settings with elevated blast\
    \ radius."
  confidence: 0.97
  derived_from:
  - 'effective permission: Microsoft.Insights/diagnosticSettings/delete'
  false_positive_note: "DEFENSE EVASION ONLY \u2014 destruction of a diagnostic setting suppresses detection\
    \ of subsequent API activity but grants no resource access and no identity tokens. Do NOT chain this\
    \ edge to CanExecuteAs, CanEscalateTo, CanEnterSubscription, or any access-escalation edge. Scope\
    \ matters: Microsoft.Insights/diagnosticSettings/delete at resource-group scope covers settings on\
    \ resources in that RG but NOT subscription-scope settings (different ARM scope); verify the effective\
    \ permission scope before asserting subscription-wide evasion. Monitoring Contributor and Contributor\
    \ / Owner roles include this action; the scoped Monitoring Reader role does NOT \u2014 do not infer\
    \ delete from read-only role assignments. A CanNotDelete resource lock prevents deletion even with\
    \ the RBAC action \u2014 emit BLOCKED if a lock is confirmed on the resource."
  narrative: '{principal.name} can delete the diagnostic setting {target.name} (Microsoft.Insights/diagnosticSettings/delete),
    stopping all export of resource logs and activity events from the monitored scope to the configured
    destination (Log Analytics workspace, storage account, or Event Hub). While the setting is absent,
    subsequent attacker actions in that scope go unrecorded. This is a cover-tracks / weaken-detective-controls
    primitive that grants no resource access.'