Azure Blob Permissions Modification

 1[metadata]
 2creation_date = "2021/09/22"
 3integration = ["azure"]
 4maturity = "production"
 5min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 6min_stack_version = "8.3.0"
 7updated_date = "2023/06/22"
 8
 9[rule]
10author = ["Austin Songer"]
11description = """
12Identifies when the Azure role-based access control (Azure RBAC) permissions are modified for an Azure Blob. An
13adversary may modify the permissions on a blob to weaken their target's security controls or an administrator may
14inadvertently modify the permissions, which could lead to data exposure or loss.
15"""
16false_positives = [
17    """
18    Blob permissions may be modified by system administrators. Verify that the configuration change was expected.
19    Exceptions can be added to this rule to filter expected behavior.
20    """,
21]
22index = ["filebeat-*", "logs-azure*"]
23language = "kuery"
24license = "Elastic License v2"
25name = "Azure Blob Permissions Modification"
26note = """## Setup
27
28The Azure Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
29references = ["https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles"]
30risk_score = 47
31rule_id = "d79c4b2a-6134-4edd-86e6-564a92a933f9"
32severity = "medium"
33tags = ["Domain: Cloud", "Data Source: Azure", "Use Case: Identity and Access Audit", "Tactic: Defense Evasion", "Data Source: Elastic Defend"]
34timestamp_override = "event.ingested"
35type = "query"
36
37query = '''
38event.dataset:azure.activitylogs and azure.activitylogs.operation_name:(
39     "MICROSOFT.STORAGE/STORAGEACCOUNTS/BLOBSERVICES/CONTAINERS/BLOBS/MANAGEOWNERSHIP/ACTION" or
40     "MICROSOFT.STORAGE/STORAGEACCOUNTS/BLOBSERVICES/CONTAINERS/BLOBS/MODIFYPERMISSIONS/ACTION") and
41  event.outcome:(Success or success)
42'''
43
44
45[[rule.threat]]
46framework = "MITRE ATT&CK"
47[[rule.threat.technique]]
48id = "T1222"
49name = "File and Directory Permissions Modification"
50reference = "https://attack.mitre.org/techniques/T1222/"
51
52
53[rule.threat.tactic]
54id = "TA0005"
55name = "Defense Evasion"
56reference = "https://attack.mitre.org/tactics/TA0005/"