Executive Summary
In many modern cyber attacks, adversaries prioritize disabling or blinding the Security Information and Event Management (SIEM) system before proceeding with visible malicious activity. This report details critical vulnerabilities within Microsoft Sentinel management, where attackers may delete analytic rules, truncate data retention periods, or disable data connectors to ensure their presence remains undetected.
Technical analysis shows that these tampering activities are often logged in AzureActivity, SentinelAudit, and SentinelHealth tables, but they are rarely monitored by SOC teams. By targeting the SIEM's foundation—including automation playbooks and RBAC roles—threat actors can effectively neutralize an organization's response capability. Defending these systems requires high-fidelity monitoring of SIEM-internal changes and strict governance over administrative accounts.