Azure Storage Accounts - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/azure-storage-accounts/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 09 Jan 2024 16:00:00 +0000Unusual Azure Storage Account Key Access by Privileged Userhttps://feed.craftedsignal.io/briefs/2024-01-azure-storage-key-access/Tue, 09 Jan 2024 16:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-azure-storage-key-access/Detects unusual access to Azure Storage Account keys by users with Owner, Contributor, Storage Account Contributor, or User Access Administrator roles, potentially indicating compromised identities as seen in STORM-0501 ransomware campaigns.This threat brief focuses on the detection of unusual access patterns to Azure Storage Account keys, specifically by users holding high-privilege roles such as Owner, Contributor, Storage Account Contributor, or User Access Administrator. The access of these keys allows for full administrative control over the storage resources. Microsoft recommends using Shared Access Signature (SAS) models instead of direct key access for improved security. This behavior was observed in STORM-0501 ransomware campaigns, where compromised identities with elevated Azure RBAC roles retrieved storage account keys to conduct unauthorized operations on the storage accounts. The detection strategy focuses on identifying when a user principal with these high-privilege roles accesses storage keys for the first time within a 7-day window, highlighting potentially malicious or anomalous behavior.

Attack Chain

  1. Initial compromise of a user account with a high-privilege Azure RBAC role (Owner, Contributor, Storage Account Contributor, or User Access Administrator). This may be achieved through phishing or credential stuffing.
  2. The compromised account logs into the Azure portal or uses Azure CLI/PowerShell with valid credentials.
  3. Attacker enumerates available Azure Storage Accounts within the subscription.
  4. Using the compromised account, the attacker executes the MICROSOFT.STORAGE/STORAGEACCOUNTS/LISTKEYS/ACTION operation to retrieve the storage account keys.
  5. The attacker uses the retrieved storage account keys to perform unauthorized actions on the Storage Account, such as reading, modifying, or deleting data.
  6. Data exfiltration occurs using the compromised storage account keys, potentially involving tools like AzCopy or custom scripts.
  7. The attacker may attempt to move laterally to other storage accounts or Azure resources using the compromised keys.
  8. Ransomware deployment within the storage account, encrypting data and demanding payment for its recovery, as observed in STORM-0501 campaigns.

Impact

A successful attack can lead to unauthorized data access, modification, or deletion within Azure Storage Accounts. The impact includes potential data breaches, financial losses, and reputational damage. As observed with STORM-0501, compromised storage account keys can facilitate ransomware deployment, rendering critical data inaccessible until a ransom is paid. Organizations in all sectors that utilize Azure Storage Accounts are potentially vulnerable. The compromise can allow attackers full control over the storage account leading to complete data loss.

Recommendation

  • Implement the Sigma rule "Azure Storage Account Keys Accessed by Privileged User - New Access" to detect first-time key access within 7 days by privileged users based on azure.activitylogs.operation_name: "MICROSOFT.STORAGE/STORAGEACCOUNTS/LISTKEYS/ACTION" and event.outcome: "success".
  • Enable Azure Activity Logs and ensure they are being ingested into your SIEM to provide the data source necessary for the provided Sigma rules.
  • Rotate storage account keys immediately upon detection of unauthorized access and audit recent activities on the affected storage accounts.
  • Enforce the use of Azure AD authentication or SAS tokens instead of storage account keys to reduce future risks, as recommended by Microsoft.
  • Review and restrict the assignment of high-privilege roles like Owner and Contributor, following the principle of least privilege.
  • Configure Azure Policy to restrict the listKeys operation to specific roles or require additional approval workflows.
]]>mediumthreatazurestorage accountcredential accessransomwareMultiple Azure Storage Account Deletions by Userhttps://feed.craftedsignal.io/briefs/2024-01-02-azure-storage-deletion/Tue, 02 Jan 2024 10:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-02-azure-storage-deletion/A single user or service principal deleting multiple Azure Storage Accounts within a short time period may indicate malicious activity such as data destruction, service disruption, or a ransomware attack.This detection identifies when a single user or service principal deletes multiple Azure Storage Accounts within a short time period. This behavior can indicate an adversary attempting to cause widespread service disruption, destroy evidence, or execute a destructive attack such as ransomware. Mass deletion of storage accounts can have severe business impact and is rarely performed by legitimate administrators except during controlled decommissioning activities. The original Elastic detection rule was published on 2025/10/08 and updated on 2026/04/10. This threat is important for defenders because Azure Storage Accounts are critical infrastructure components that store application data, backups, and business-critical information.

Attack Chain

  1. An attacker gains unauthorized access to an Azure account or service principal.
  2. The attacker enumerates available Azure Storage Accounts within the subscription.
  3. The attacker uses the Azure portal, CLI, or API to initiate deletion of multiple storage accounts.
  4. Azure Activity Logs record the "MICROSOFT.STORAGE/STORAGEACCOUNTS/DELETE" operations.
  5. The attacker attempts to disable or delete backups to hinder recovery efforts.
  6. If successful, the deletion of storage accounts results in data loss and service disruption.
  7. The attacker may attempt to exfiltrate additional data before final deletion.
  8. The attack aims to cause maximum impact by deleting as many storage accounts as possible in a short timeframe.

Impact

Mass deletion of storage accounts can result in significant data loss, service disruption, and financial damage. The number of affected storage accounts can vary, but the impact is generally high due to the critical nature of stored data. This attack could impact any organization using Azure Storage Accounts, including those in the technology, finance, and healthcare sectors. If successful, organizations may experience data breaches, compliance violations, and reputational damage.

Recommendation

  • Deploy the Sigma rule "Azure Storage Account Deletions by User" to your SIEM and tune for your environment.
  • Review Azure Activity Logs for the "MICROSOFT.STORAGE/STORAGEACCOUNTS/DELETE" operation to investigate potential mass deletion attempts.
  • Implement Azure Resource Locks on all critical storage accounts to prevent accidental or malicious deletion.
  • Configure Azure Policy to require approval workflows for storage account deletions using Azure Blueprints or custom governance solutions.
  • Enable Azure Activity Log alerts to notify security teams immediately when storage accounts are deleted.
]]>highadvisorycloudazurestorageimpact