Azure Blob Container Access Level Modification

 1[metadata]
 2creation_date = "2020/08/20"
 3integration = ["azure"]
 4maturity = "production"
 5updated_date = "2024/05/21"
 6
 7[rule]
 8author = ["Elastic"]
 9description = """
10Identifies changes to container access levels in Azure. Anonymous public read access to containers and blobs in Azure is
11a way to share data broadly, but can present a security risk if access to sensitive data is not managed judiciously.
12"""
13false_positives = [
14    """
15    Access level modifications may be done by a system or network administrator. Verify whether the username, hostname,
16    and/or resource name should be making changes in your environment. Access level modifications from unfamiliar users
17    or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
18    """,
19]
20from = "now-25m"
21index = ["filebeat-*", "logs-azure*"]
22language = "kuery"
23license = "Elastic License v2"
24name = "Azure Blob Container Access Level Modification"
25note = """## Setup
26
27The Azure Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
28references = ["https://docs.microsoft.com/en-us/azure/storage/blobs/anonymous-read-access-prevent"]
29risk_score = 21
30rule_id = "2636aa6c-88b5-4337-9c31-8d0192a8ef45"
31severity = "low"
32tags = ["Domain: Cloud", "Data Source: Azure", "Use Case: Asset Visibility", "Tactic: Discovery"]
33timestamp_override = "event.ingested"
34type = "query"
35
36query = '''
37event.dataset:azure.activitylogs and azure.activitylogs.operation_name:"MICROSOFT.STORAGE/STORAGEACCOUNTS/BLOBSERVICES/CONTAINERS/WRITE" and event.outcome:(Success or success)
38'''
39
40
41[[rule.threat]]
42framework = "MITRE ATT&CK"
43[[rule.threat.technique]]
44id = "T1526"
45name = "Cloud Service Discovery"
46reference = "https://attack.mitre.org/techniques/T1526/"
47
48
49[rule.threat.tactic]
50id = "TA0007"
51name = "Discovery"
52reference = "https://attack.mitre.org/tactics/TA0007/"
53[[rule.threat]]
54framework = "MITRE ATT&CK"
55[[rule.threat.technique]]
56id = "T1190"
57name = "Exploit Public-Facing Application"
58reference = "https://attack.mitre.org/techniques/T1190/"
59
60
61[rule.threat.tactic]
62id = "TA0001"
63name = "Initial Access"
64reference = "https://attack.mitre.org/tactics/TA0001/"