Azure Storage Account Deletion Followed by Same-Name Recreation in Different Subscription

Ibrahim Saud@tektrix

•updated Jun 23, 2026•0•0•4

This rule detects a potential Azure storage account name hijacking scenario. It identifies instances where a storage account is deleted and then recreated with the exact same name in a different subscription within the same Azure tenant, all within a 60-minute window. This activity could indicate an attempt to exfiltrate data via Azure Monitor diagnostic settings by taking over a previously used storage account name.