Azure Monitor Diagnostic Settings Deleted

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•4

This rule detects when Azure Monitor Diagnostic Settings are deleted. It specifically looks for HTTP DELETE requests to 'management.azure.com' with 'diagnosticSettings' in the URI. This activity could indicate an attacker attempting to evade detection by removing logging configurations.