services / Azure / Network Watcher packet captures

A Network Watcher packet capture is a network diagnostic resource that records live network traffic to and from a target VM/endpoint and writes the captured packets to a storage account or local file.

Captured traffic can contain sensitive in-transit data including credentials, tokens, and application payloads, making the create capability effectively a data-interception tool. Status/configuration reads expose only diagnostic metadata, not the captured payload.

Microsoft.​Network/​networkWatchers/​packetCaptures/​delete

Deleting a packet capture removes the diagnostic/forensic mechanism and any captured traffic records, eliminating network-traffic visibility used for incident response.

Risks

1. Defense destruction (EVASION)

Scope: MEDIUM

This privilege may grant access to confidential data, or its exploit can incur operational cost.

Links