Data Source: Azure Platform Logs

Azure Storage Blob Retrieval via AzCopy

Oct 16, 2025 · Domain: Cloud Domain: Storage Data Source: Azure Data Source: Azure Platform Logs Data Source: Azure Storage Use Case: Threat Detection Tactic: Exfiltration Resources: Investigation Guide ·

Share on:

Identifies successful GetBlob operations on Azure Storage Accounts using AzCopy user agent with SAS token authentication. AzCopy is a command-line utility for copying data to and from Azure Storage. While legitimate for data migration, adversaries may abuse AzCopy with compromised SAS tokens to exfiltrate data from Azure Storage Accounts. This rule detects the first occurrence of GetBlob operations from a specific storage account using this pattern.

Excessive Secret or Key Retrieval from Azure Key Vault

Oct 14, 2025 · Domain: Cloud Domain: Storage Domain: Identity Data Source: Azure Data Source: Azure Platform Logs Data Source: Azure Key Vault Use Case: Threat Detection Use Case: Identity and Access Audit Tactic: Credential Access Resources: Investigation Guide ·

Share on:

Identifies excessive secret or key retrieval operations from Azure Key Vault. This rule detects when a user principal retrieves secrets or keys from Azure Key Vault multiple times within a short time frame, which may indicate potential abuse or unauthorized access attempts. The rule focuses on high-frequency retrieval operations that deviate from normal user behavior, suggesting possible credential harvesting or misuse of sensitive information.

Azure Key Vault Secret Key Usage by Unusual Identity

Jul 22, 2025 · Domain: Cloud Domain: Storage Domain: Identity Data Source: Azure Data Source: Azure Platform Logs Data Source: Azure Key Vault Use Case: Threat Detection Use Case: Identity and Access Audit Tactic: Credential Access Resources: Investigation Guide ·

Share on:

Identifies secrets, keys, or certificates retrieval operations from Azure Key Vault by a user principal that has not been seen previously doing so in a certain amount of days. Azure Key Vault is a cloud service for securely storing and accessing secrets, keys, and certificates. Unauthorized or excessive retrievals may indicate potential abuse or unauthorized access attempts.