azure-siem-workspace-delete
Delete a Log Analytics workspace, destroying all ingested log evidence (defense evasion - cover tracks). Soft-delete for 14 days unless purge is forced. This is resource destruction (CanDelete), not data-row deletion (CanDeleteData). CanDeleteData target set [Storage, Data] excludes LoggingService (ManagementService), so CanDelete (target=*) is semantically correct for resource-level destruction.
match (effective permission)
{
"action": "Microsoft.OperationalInsights/workspaces/delete",
"scope_type": "resource|resourceGroup|subscription"
}
emit
| source type | Identity |
|---|---|
| target type | LoggingService |
| source | <principal> |
| target | <Log Analytics workspace (LoggingService)> |
| permissions | Microsoft.OperationalInsights/workspaces/delete |
| state logic | ACTIVE when the effective permission is confirmed; BLOCKED if a deny assignment covers workspaces/delete. Note: workspace deletion is soft for 14 days (recoverable by an authorized admin); permanent loss occurs only after retention period or if the workspace has never had a linked cluster (then immediate hard delete is possible). The evasion impact degrades over time if the workspace is recovered. |
Narrative
{principal.name} can delete Log Analytics workspace {target.name} (Microsoft.OperationalInsights/workspaces/delete), destroying all ingested log and Sentinel alert data. This is a cover-tracks primitive that eliminates forensic evidence - it does NOT grant access to other Azure resources.
Raw rule rules/derived/azure/loganalytics.yaml
id: azure-siem-workspace-delete
emits: CanDelete
description: "Delete a Log Analytics workspace, destroying all ingested log evidence (defense evasion\
\ \u2014 cover tracks). Soft-delete for 14 days unless purge is forced. This is resource destruction\
\ (CanDelete), not data-row deletion (CanDeleteData). CanDeleteData target set [Storage, Data] excludes\
\ LoggingService (ManagementService), so CanDelete (target=*) is semantically correct for resource-level\
\ destruction."
match_effective_permission:
action: Microsoft.OperationalInsights/workspaces/delete
scope_type: resource|resourceGroup|subscription
emit:
source_type: Identity
target_type: LoggingService
source: <principal>
target: <Log Analytics workspace (LoggingService)>
permissions:
- Microsoft.OperationalInsights/workspaces/delete
conditions: []
state_logic: 'ACTIVE when the effective permission is confirmed; BLOCKED if a deny assignment covers
workspaces/delete. Note: workspace deletion is soft for 14 days (recoverable by an authorized admin);
permanent loss occurs only after retention period or if the workspace has never had a linked cluster
(then immediate hard delete is possible). The evasion impact degrades over time if the workspace is
recovered.'
confidence: 0.95
derived_from:
- 'effective permission: Microsoft.OperationalInsights/workspaces/delete'
false_positive_note: "EVASION, NOT ESCALATION. Deleting the workspace removes detective capability (no\
\ logs, no Sentinel alerts) but does NOT grant access to any other Azure resource. Do NOT chain this\
\ to CanEnterSubscription, CanExecuteAs, or any privilege-escalation edge. The 14-day soft-delete\
\ means recovery is possible if another admin acts quickly \u2014 set confidence 0.95 (lower than\
\ irreversible purge) to reflect the partial recoverability. This reduces detection, not grants access."
narrative: "{principal.name} can delete Log Analytics workspace {target.name} (Microsoft.OperationalInsights/workspaces/delete),\
\ destroying all ingested log and Sentinel alert data. This is a cover-tracks primitive that eliminates\
\ forensic evidence \u2014 it does NOT grant access to other Azure resources."