Azure Storage Account

Storm-3168 (linked to JADEPUFFER) leverages compromised Azure service principals to execute automated resource destruction and credential exfiltration through AI-orchestrated cloud API manipulation.

This brief detects the deletion of Azure Storage Accounts which can indicate malicious activity like data destruction, denial of service, or covering tracks after data exfiltration by adversaries.

Detection of Azure Storage Account key regeneration events, which can signify potential credential access or persistence attempts by adversaries aiming to gain unauthorized access or disrupt services.

Detection of Azure Storage Account Blob public access being enabled, potentially allowing external access to blob containers for data exfiltration, as abused by threat actors modifying storage account settings.