[New Rule] Azure Network Watcher Deletion

[bm11100]

Issue(s)

resolves #197

Description

Identifies the deletion of a Network Watcher in Azure. Network Watchers are used to monitor, diagnose, view metrics, and enable or disable logs for resources in an Azure virtual network. An adversary may delete a Network Watcher in an attempt to evade defenses.

Checklists

Use strikethroughs to remove items which are not applicable to this issue.

For submitter

• Verify all query fields co-exist in a single event source (beats) or annotated otherwise
  -- Query field process.name.text doesn't currently exist in endgame- eventing data, but does exist for winlogbeats, and is case insensitive.
• Verify all query fields co-exist within a single ECS version and annotated the minimum version
  -- 1.4.0
• Verified the query detects the intended event(s)
  • detonate
  • search in discover
  • trigger as a custom signal
• Create rule using create-rule
• Verify and convert to standard linting (toml-lint -f <rule-file>)
• Run tests using pytest -x -v unit_tests or make test
• Internal search to determine noise and FP

For reviewers

• Verify existing rule for activity doesn't exist as a siem or endpoint rule (unless intentionally specified in issue)
• Verify all query fields co-exist in a single event source (*beats) or annotated otherwise
• Verify all query fields co-exist within a single ECS version and annotated the minimum version
• Internal search to determine noise and FP
• Verify metadata accuracy and spelling

[brokensound77]

LGTM 👍