Azure Blob Container Access Level Modification
Identifies changes to container access levels in Azure. Anonymous public read access to containers and blobs in Azure is a way to share data broadly, but can present a security risk if access to sensitive data is not managed judiciously.
Elastic rule (View on GitHub)
1[metadata]
2creation_date = "2020/08/20"
3integration = ["azure"]
4maturity = "production"
5min_stack_comments = "New fields added: required_fields, related_integrations, setup"
6min_stack_version = "8.3.0"
7updated_date = "2023/06/22"
8
9[rule]
10author = ["Elastic"]
11description = """
12Identifies changes to container access levels in Azure. Anonymous public read access to containers and blobs in Azure is
13a way to share data broadly, but can present a security risk if access to sensitive data is not managed judiciously.
14"""
15false_positives = [
16 """
17 Access level modifications may be done by a system or network administrator. Verify whether the username, hostname,
18 and/or resource name should be making changes in your environment. Access level modifications from unfamiliar users
19 or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
20 """,
21]
22from = "now-25m"
23index = ["filebeat-*", "logs-azure*"]
24language = "kuery"
25license = "Elastic License v2"
26name = "Azure Blob Container Access Level Modification"
27note = """## Setup
28
29The Azure Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
30references = ["https://docs.microsoft.com/en-us/azure/storage/blobs/anonymous-read-access-prevent"]
31risk_score = 21
32rule_id = "2636aa6c-88b5-4337-9c31-8d0192a8ef45"
33severity = "low"
34tags = ["Domain: Cloud", "Data Source: Azure", "Use Case: Asset Visibility", "Tactic: Discovery"]
35timestamp_override = "event.ingested"
36type = "query"
37
38query = '''
39event.dataset:azure.activitylogs and azure.activitylogs.operation_name:"MICROSOFT.STORAGE/STORAGEACCOUNTS/BLOBSERVICES/CONTAINERS/WRITE" and event.outcome:(Success or success)
40'''
41
42
43[[rule.threat]]
44framework = "MITRE ATT&CK"
45[[rule.threat.technique]]
46id = "T1526"
47name = "Cloud Service Discovery"
48reference = "https://attack.mitre.org/techniques/T1526/"
49
50
51[rule.threat.tactic]
52id = "TA0007"
53name = "Discovery"
54reference = "https://attack.mitre.org/tactics/TA0007/"
55[[rule.threat]]
56framework = "MITRE ATT&CK"
57[[rule.threat.technique]]
58id = "T1190"
59name = "Exploit Public-Facing Application"
60reference = "https://attack.mitre.org/techniques/T1190/"
61
62
63[rule.threat.tactic]
64id = "TA0001"
65name = "Initial Access"
66reference = "https://attack.mitre.org/tactics/TA0001/"
Setup
The Azure Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
References
Related rules
- Azure Kubernetes Pods Deleted
- Azure AD Global Administrator Role Assigned
- Azure Active Directory High Risk Sign-in
- Azure Active Directory High Risk User Sign-in Heuristic
- Azure Active Directory PowerShell Sign-in