Delete Cloud Instance

// T1578.003 — Delete Cloud Instance
// Detects VM/instance deletion events across Azure and AWS in Microsoft Sentinel
let AzureDeleteOps = dynamic([
    "Microsoft.Compute/virtualMachines/delete",
    "Microsoft.Compute/virtualMachineScaleSets/delete",
    "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/delete",
    "Microsoft.ClassicCompute/virtualMachines/delete",
    "Microsoft.ContainerService/managedClusters/delete"
]);
// Azure Activity Log — VM deletions
let AzureVMDeletes = AzureActivity
| where TimeGenerated > ago(24h)
| where OperationNameValue in~ (AzureDeleteOps)
| where ActivityStatusValue in~ ("Success", "Accepted", "Succeeded", "Started")
| extend CloudProvider = "Azure"
| extend CallerIdentity = Caller
| extend OperationType = OperationNameValue
| extend ResourceName = Resource
| extend AccountType = iif(CallerIdentity has "@", "UserAccount", "ServicePrincipal")
| project TimeGenerated, CloudProvider, CallerIdentity, AccountType, OperationType,
          ResourceName, ResourceGroup, SubscriptionId, ResourceId,
          ActivityStatusValue, Properties, HTTPRequest;
// AWS CloudTrail — Instance terminations
let AWSInstanceTerminations = AWSCloudTrail
| where TimeGenerated > ago(24h)
| where EventName in ("TerminateInstances", "DeleteInstance", "DeregisterInstance")
| where isempty(ErrorCode)
| extend CloudProvider = "AWS"
| extend CallerIdentity = UserIdentityArn
| extend AccountType = UserIdentityType
| extend OperationType = EventName
| extend ResourceName = tostring(RequestParameters)
| project TimeGenerated, CloudProvider, CallerIdentity, AccountType, OperationType,
          ResourceName, SourceIpAddress, AWSRegion, UserIdentityAccountId,
          UserIdentityType, SessionCreationDate, AdditionalEventData;
// Union both cloud providers
AzureVMDeletes
| union AWSInstanceTerminations
| sort by TimeGenerated desc

| tstats summariesonly=false allow_old_summaries=true count min(_time) as firstTime max(_time) as lastTime
    from datamodel=Cloud_Infrastructure where
    (Cloud_Infrastructure.action=deleted OR Cloud_Infrastructure.action=terminate OR Cloud_Infrastructure.action=deregister)
    AND Cloud_Infrastructure.object_category=instance
    by Cloud_Infrastructure.user, Cloud_Infrastructure.src, Cloud_Infrastructure.object, Cloud_Infrastructure.action, Cloud_Infrastructure.vendor_account, Cloud_Infrastructure.region
| rename Cloud_Infrastructure.* as *
| eval DeleteType="generic"
| append
    [ search index=aws sourcetype=aws:cloudtrail EventName IN ("TerminateInstances","DeleteInstance","DeregisterInstance") errorCode=""
      | eval CloudProvider="AWS"
      | eval CallerIdentity=coalesce(userIdentity.arn, userIdentity.userName, "unknown")
      | eval AccountType=userIdentity.type
      | eval TargetInstances=mvindex(split(tostring(requestParameters.instancesSet.items), ","), 0, 10)
      | eval InstanceCount=mvcount(split(tostring(requestParameters.instancesSet.items), ","))
      | eval DeleteType=if(InstanceCount > 5, "BulkDelete", "SingleDelete")
      | eval SuspicionScore=0
      | eval SuspicionScore=SuspicionScore + if(InstanceCount > 10, 3, if(InstanceCount > 3, 1, 0))
      | eval SuspicionScore=SuspicionScore + if(AccountType="Root", 3, 0)
      | eval SuspicionScore=SuspicionScore + if(match(sourceIPAddress, "^(3\..*|52\..*|54\..*)$") AND AccountType!="AWSService", 1, 0)
      | table _time, CloudProvider, CallerIdentity, AccountType, EventName, awsRegion, sourceIPAddress, TargetInstances, InstanceCount, DeleteType, SuspicionScore, recipientAccountId
    ]
| append
    [ search index=azure sourcetype=azure:monitor:activity operationName="Microsoft.Compute/virtualMachines/delete" OR operationName="Microsoft.Compute/virtualMachineScaleSets/delete" status.value="Succeeded"
      | eval CloudProvider="Azure"
      | eval CallerIdentity=coalesce(caller, "unknown")
      | eval AccountType=if(match(CallerIdentity, "@"), "UserAccount", "ServicePrincipal")
      | eval ResourceName=coalesce(resourceId, "unknown")
      | eval SuspicionScore=0
      | eval SuspicionScore=SuspicionScore + if(AccountType="UserAccount" AND match(operationName, "delete"), 2, 0)
      | eval SuspicionScore=SuspicionScore + if(match(ResourceName, "(?i)(prod|production|critical|primary)"), 2, 0)
      | table _time, CloudProvider, CallerIdentity, AccountType, operationName, subscriptionId, resourceGroupName, ResourceName, SuspicionScore
    ]
| where SuspicionScore >= 1 OR InstanceCount > 3 OR DeleteType="BulkDelete"
| sort - _time

any where event.dataset == "azure.activitylogs"
  and event.action : ("Microsoft.Compute/snapshots/write", "Microsoft.Compute/virtualMachines/write",
                      "Microsoft.Compute/virtualMachines/delete", "Microsoft.Compute/disks/write")
  and not user.name : ("azure-backup-service", "azure-site-recovery")

SELECT
  DATEFORMAT(devicetime,'yyyy-MM-dd HH:mm:ss') AS EventTime,
  username, "Operation" AS CloudOperation,
  "ResourceType" AS CloudResource,
  "ResourceGroup", "SubscriptionId",
  CASE
    WHEN "Operation" ILIKE '%delete%' OR "Operation" ILIKE '%destroy%' THEN 90
    WHEN "Operation" ILIKE '%snapshot%' AND "ResultType" = 'Success' THEN 70
    WHEN "Operation" ILIKE '%create%instance%' THEN 60
    ELSE 40
  END AS RiskScore,
  CASE
    WHEN "Operation" ILIKE '%delete%' THEN 'Cloud Resource Deletion'
    WHEN "Operation" ILIKE '%snapshot%' THEN 'Snapshot Operation'
    WHEN "Operation" ILIKE '%create%' THEN 'Cloud Resource Creation'
    ELSE 'Cloud Modification'
  END AS AlertType
FROM events
WHERE LOGSOURCETYPENAME(devicetype) ILIKE '%azure%' OR LOGSOURCETYPENAME(devicetype) ILIKE '%cloudtrail%'
  AND ("Operation" ILIKE '%compute%' OR "Operation" ILIKE '%instance%' OR "Operation" ILIKE '%snapshot%' OR "Operation" ILIKE '%virtualMachine%')
  AND username NOT ILIKE '%azure%automation%'
  AND username NOT ILIKE '%backup%service%'
ORDER BY RiskScore DESC
LAST 1 HOURS

_sourceCategory=*azure*activitylog* OR _sourceCategory=*aws*cloudtrail*
| json auto
| where matches(operationName, "(?i)(snapshot|virtualMachine|instance|compute|create|delete|modify)")
| eval RiskLevel = if(matches(operationName, "(?i)(delete|destroy|terminate)"), "High",
    if(matches(operationName, "(?i)(snapshot|create)"), "Medium", "Low"))
| where RiskLevel in ("High","Medium")
| eval AlertType = if(matches(operationName, "(?i)delete"), "Cloud Resource Deletion",
    if(matches(operationName, "(?i)snapshot"), "Snapshot Operation",
    if(matches(operationName, "(?i)create"), "Resource Creation", "Cloud Modification")))
| where caller != "azure-backup" and !matches(caller, "(?i)automation")
| stats count AS OpCount, values(operationName) AS Operations, values(RiskLevel) AS RiskLevels by _sourceHost, caller, resourceGroup
| sort by OpCount desc

rule T1578_003_cloud_infra_modification {
  meta:
    author = "Detection Engineering"
    description = "Detects suspicious cloud infrastructure modifications"
    severity = "high"
    confidence = "medium"
    mitre_attack = "T1578.003"
    reference = "https://attack.mitre.org/techniques/T1578/003/"

  events:
    $e.metadata.event_type = "USER_RESOURCE_ACCESS"
    re.regex($e.metadata.product_event_type, `(?i)(snapshot|virtualMachine|instance|compute|create|delete|modify)`)
    not re.regex($e.principal.user.email_addresses, `(?i)(backup|automation|serviceaccount)`)

  condition:
    $e
}

#event_simpleName = "CloudResourceModification"
| OperationName = /(?i)(snapshot|virtualMachine|instance|compute|create|delete|modify|revert)/
| ActorUserName != /(?i)(backup|automation|serviceaccount|scheduler)/
| groupBy([aid, ActorUserName, OperationName, ResourceType, ResourceName], function=[count(as=OpCount), min(timestamp, as=FirstSeen)])
| case {
    OperationName = /(?i)(delete|destroy|terminate)/ => RiskScore := "High";
    OperationName = /(?i)(snapshot|create)/ => RiskScore := "Medium";
    * => RiskScore := "Low";
  }
| where RiskScore in ("High", "Medium")
| table([ActorUserName, OperationName, ResourceType, ResourceName, OpCount, RiskScore, FirstSeen])
| sort(RiskScore)