Azure Resource Manager: Unauthorized resource group deletion detection

Azure Resource Group deletion is a permanent operation that removes all contained resources. Attackers may leverage this to perform data destruction, impair recovery by removing snapshots or backups, or cause operational disruption. This detection uses an ES|QL first-seen approach to alert on resource group deletions performed by principals that have not executed this action in the preceding 7 days, helping to filter routine infrastructure-as-code or CI/CD activity while flagging anomalous identity behavior.

Impact

Deletion of a resource group is irreversible and removes all resources within it. Observed impact can range from authorized environment teardown by automated pipelines to unauthorized destruction of production infrastructure or defensive evasion by clearing logs and supporting resources.

Recommendation

• Deploy the ES|QL detection logic provided by Elastic to flag first-time resource group deletions.
• Establish a baseline of known CI/CD, IaC, and platform service principals and investigate any alerts triggered by identities outside this scope.
• Implement Azure Policy or management locks on critical production resource groups to prevent accidental or unauthorized deletion.
• Require privileged delete operations to proceed via Privileged Identity Management (PIM) or approved change-control pipelines.