{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/azure-storage-accounts/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":["Storm-0501"],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Microsoft Azure","Azure Storage Accounts"],"_cs_severities":["medium"],"_cs_tags":["azure","storage account","credential access","ransomware"],"_cs_type":"threat","_cs_vendors":["Microsoft"],"content_html":"\u003cp\u003eThis threat brief focuses on the detection of unusual access patterns to Azure Storage Account keys, specifically by users holding high-privilege roles such as Owner, Contributor, Storage Account Contributor, or User Access Administrator. The access of these keys allows for full administrative control over the storage resources. Microsoft recommends using Shared Access Signature (SAS) models instead of direct key access for improved security. This behavior was observed in STORM-0501 ransomware campaigns, where compromised identities with elevated Azure RBAC roles retrieved storage account keys to conduct unauthorized operations on the storage accounts. The detection strategy focuses on identifying when a user principal with these high-privilege roles accesses storage keys for the first time within a 7-day window, highlighting potentially malicious or anomalous behavior.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eInitial compromise of a user account with a high-privilege Azure RBAC role (Owner, Contributor, Storage Account Contributor, or User Access Administrator). This may be achieved through phishing or credential stuffing.\u003c/li\u003e\n\u003cli\u003eThe compromised account logs into the Azure portal or uses Azure CLI/PowerShell with valid credentials.\u003c/li\u003e\n\u003cli\u003eAttacker enumerates available Azure Storage Accounts within the subscription.\u003c/li\u003e\n\u003cli\u003eUsing the compromised account, the attacker executes the \u003ccode\u003eMICROSOFT.STORAGE/STORAGEACCOUNTS/LISTKEYS/ACTION\u003c/code\u003e operation to retrieve the storage account keys.\u003c/li\u003e\n\u003cli\u003eThe attacker uses the retrieved storage account keys to perform unauthorized actions on the Storage Account, such as reading, modifying, or deleting data.\u003c/li\u003e\n\u003cli\u003eData exfiltration occurs using the compromised storage account keys, potentially involving tools like AzCopy or custom scripts.\u003c/li\u003e\n\u003cli\u003eThe attacker may attempt to move laterally to other storage accounts or Azure resources using the compromised keys.\u003c/li\u003e\n\u003cli\u003eRansomware deployment within the storage account, encrypting data and demanding payment for its recovery, as observed in STORM-0501 campaigns.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eA successful attack can lead to unauthorized data access, modification, or deletion within Azure Storage Accounts. The impact includes potential data breaches, financial losses, and reputational damage. As observed with STORM-0501, compromised storage account keys can facilitate ransomware deployment, rendering critical data inaccessible until a ransom is paid. Organizations in all sectors that utilize Azure Storage Accounts are potentially vulnerable. The compromise can allow attackers full control over the storage account leading to complete data loss.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImplement the Sigma rule \u0026quot;Azure Storage Account Keys Accessed by Privileged User - New Access\u0026quot; to detect first-time key access within 7 days by privileged users based on \u003ccode\u003eazure.activitylogs.operation_name: \u0026quot;MICROSOFT.STORAGE/STORAGEACCOUNTS/LISTKEYS/ACTION\u0026quot;\u003c/code\u003e and \u003ccode\u003eevent.outcome: \u0026quot;success\u0026quot;\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eEnable Azure Activity Logs and ensure they are being ingested into your SIEM to provide the data source necessary for the provided Sigma rules.\u003c/li\u003e\n\u003cli\u003eRotate storage account keys immediately upon detection of unauthorized access and audit recent activities on the affected storage accounts.\u003c/li\u003e\n\u003cli\u003eEnforce the use of Azure AD authentication or SAS tokens instead of storage account keys to reduce future risks, as recommended by Microsoft.\u003c/li\u003e\n\u003cli\u003eReview and restrict the assignment of high-privilege roles like Owner and Contributor, following the principle of least privilege.\u003c/li\u003e\n\u003cli\u003eConfigure Azure Policy to restrict the \u003ccode\u003elistKeys\u003c/code\u003e operation to specific roles or require additional approval workflows.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2024-01-09T16:00:00Z","date_published":"2024-01-09T16:00:00Z","id":"https://feed.craftedsignal.io/briefs/2024-01-azure-storage-key-access/","summary":"Detects unusual access to Azure Storage Account keys by users with Owner, Contributor, Storage Account Contributor, or User Access Administrator roles, potentially indicating compromised identities as seen in STORM-0501 ransomware campaigns.","title":"Unusual Azure Storage Account Key Access by Privileged User","url":"https://feed.craftedsignal.io/briefs/2024-01-azure-storage-key-access/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Azure","Azure Storage Accounts"],"_cs_severities":["high"],"_cs_tags":["cloud","azure","storage","impact"],"_cs_type":"advisory","_cs_vendors":["Microsoft"],"content_html":"\u003cp\u003eThis detection identifies when a single user or service principal deletes multiple Azure Storage Accounts within a short time period. This behavior can indicate an adversary attempting to cause widespread service disruption, destroy evidence, or execute a destructive attack such as ransomware. Mass deletion of storage accounts can have severe business impact and is rarely performed by legitimate administrators except during controlled decommissioning activities. The original Elastic detection rule was published on 2025/10/08 and updated on 2026/04/10. This threat is important for defenders because Azure Storage Accounts are critical infrastructure components that store application data, backups, and business-critical information.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker gains unauthorized access to an Azure account or service principal.\u003c/li\u003e\n\u003cli\u003eThe attacker enumerates available Azure Storage Accounts within the subscription.\u003c/li\u003e\n\u003cli\u003eThe attacker uses the Azure portal, CLI, or API to initiate deletion of multiple storage accounts.\u003c/li\u003e\n\u003cli\u003eAzure Activity Logs record the \u0026quot;MICROSOFT.STORAGE/STORAGEACCOUNTS/DELETE\u0026quot; operations.\u003c/li\u003e\n\u003cli\u003eThe attacker attempts to disable or delete backups to hinder recovery efforts.\u003c/li\u003e\n\u003cli\u003eIf successful, the deletion of storage accounts results in data loss and service disruption.\u003c/li\u003e\n\u003cli\u003eThe attacker may attempt to exfiltrate additional data before final deletion.\u003c/li\u003e\n\u003cli\u003eThe attack aims to cause maximum impact by deleting as many storage accounts as possible in a short timeframe.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eMass deletion of storage accounts can result in significant data loss, service disruption, and financial damage. The number of affected storage accounts can vary, but the impact is generally high due to the critical nature of stored data. This attack could impact any organization using Azure Storage Accounts, including those in the technology, finance, and healthcare sectors. If successful, organizations may experience data breaches, compliance violations, and reputational damage.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the Sigma rule \u0026quot;Azure Storage Account Deletions by User\u0026quot; to your SIEM and tune for your environment.\u003c/li\u003e\n\u003cli\u003eReview Azure Activity Logs for the \u0026quot;MICROSOFT.STORAGE/STORAGEACCOUNTS/DELETE\u0026quot; operation to investigate potential mass deletion attempts.\u003c/li\u003e\n\u003cli\u003eImplement Azure Resource Locks on all critical storage accounts to prevent accidental or malicious deletion.\u003c/li\u003e\n\u003cli\u003eConfigure Azure Policy to require approval workflows for storage account deletions using Azure Blueprints or custom governance solutions.\u003c/li\u003e\n\u003cli\u003eEnable Azure Activity Log alerts to notify security teams immediately when storage accounts are deleted.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2024-01-02T10:00:00Z","date_published":"2024-01-02T10:00:00Z","id":"https://feed.craftedsignal.io/briefs/2024-01-02-azure-storage-deletion/","summary":"A single user or service principal deleting multiple Azure Storage Accounts within a short time period may indicate malicious activity such as data destruction, service disruption, or a ransomware attack.","title":"Multiple Azure Storage Account Deletions by User","url":"https://feed.craftedsignal.io/briefs/2024-01-02-azure-storage-deletion/"}],"language":"en","title":"CraftedSignal Threat Feed - Azure Storage Accounts","version":"https://jsonfeed.org/version/1.1"}