Skip to content

AZT704 - Soft-Delete Recovery#

An adversary may leverage resources found at a 'soft deletion' state, restore them and advance their attack by retrieving contents meant to be deleted

ID Name Description Action Resources
AZT704.1 Key Vault An adversary may recover a key vault object found in a 'soft deletion' state. Microsoft.KeyVault/vaults//restore Key Vault
AZT704.2 Storage Account Object An adversary may recover a storage account object found in a 'soft deletion' state. Microsoft.Storage/storageAccounts/blobServices/\/ Azure Storage Account
AZT704.3 Recovery Services Vault An adversary may recover a virtual machine object found in a 'soft deletion' state. Microsoft.RecoveryServices/Vaults/backupconfig/write Azure Recovery Services Vault