services / Azure / Network Watcher

Azure Network Watcher is a regional network diagnostics and monitoring service that provides flow logging, topology, and connectivity/troubleshooting tools for resources in a virtual network.

Network Watcher is a monitoring/diagnostics control-plane resource, not a data store; its main risk is as an evasion vector (disabling flow logging, removing the resource) and as a built-in network reconnaissance toolkit exposed via its action sub-resources.

Microsoft.​Network/​networkWatchers/​delete

Deleting the Network Watcher for a region removes that region's flow-logging, topology, and diagnostic capability entirely, blinding defenders to network activity in the region.

Risks

1. Defense destruction (EVASION)

Scope: MEDIUM

This privilege may grant access to confidential data, or its exploit can incur operational cost.

Links