services / Azure / Site Recovery replication recovery plan

A Site Recovery recovery plan orchestrates failover of a group of protected items in a defined sequence, including pre/post steps such as Azure Automation runbooks and manual actions.

Recovery plans define the org's coordinated failover orchestration and can invoke automation; manipulating one can sabotage recovery or inject attacker-controlled steps, and deleting one removes the ability to recover the grouped workloads in a coordinated way.

Microsoft.​RecoveryServices/​Vaults/​replicationRecoveryPlans/​delete

Deleting a recovery plan removes the orchestration needed to fail the grouped workloads over in a coordinated way, degrading disaster-recovery capability even though the underlying protected items persist.

Risks

1. Defense destruction (EVASION)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links