Storage Account - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/storage-account/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 09 Jan 2024 16:00:00 +0000Unusual Azure Storage Account Key Access by Privileged Userhttps://feed.craftedsignal.io/briefs/2024-01-azure-storage-key-access/Tue, 09 Jan 2024 16:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-azure-storage-key-access/Detects unusual access to Azure Storage Account keys by users with Owner, Contributor, Storage Account Contributor, or User Access Administrator roles, potentially indicating compromised identities as seen in STORM-0501 ransomware campaigns.This threat brief focuses on the detection of unusual access patterns to Azure Storage Account keys, specifically by users holding high-privilege roles such as Owner, Contributor, Storage Account Contributor, or User Access Administrator. The access of these keys allows for full administrative control over the storage resources. Microsoft recommends using Shared Access Signature (SAS) models instead of direct key access for improved security. This behavior was observed in STORM-0501 ransomware campaigns, where compromised identities with elevated Azure RBAC roles retrieved storage account keys to conduct unauthorized operations on the storage accounts. The detection strategy focuses on identifying when a user principal with these high-privilege roles accesses storage keys for the first time within a 7-day window, highlighting potentially malicious or anomalous behavior.

Attack Chain

  1. Initial compromise of a user account with a high-privilege Azure RBAC role (Owner, Contributor, Storage Account Contributor, or User Access Administrator). This may be achieved through phishing or credential stuffing.
  2. The compromised account logs into the Azure portal or uses Azure CLI/PowerShell with valid credentials.
  3. Attacker enumerates available Azure Storage Accounts within the subscription.
  4. Using the compromised account, the attacker executes the MICROSOFT.STORAGE/STORAGEACCOUNTS/LISTKEYS/ACTION operation to retrieve the storage account keys.
  5. The attacker uses the retrieved storage account keys to perform unauthorized actions on the Storage Account, such as reading, modifying, or deleting data.
  6. Data exfiltration occurs using the compromised storage account keys, potentially involving tools like AzCopy or custom scripts.
  7. The attacker may attempt to move laterally to other storage accounts or Azure resources using the compromised keys.
  8. Ransomware deployment within the storage account, encrypting data and demanding payment for its recovery, as observed in STORM-0501 campaigns.

Impact

A successful attack can lead to unauthorized data access, modification, or deletion within Azure Storage Accounts. The impact includes potential data breaches, financial losses, and reputational damage. As observed with STORM-0501, compromised storage account keys can facilitate ransomware deployment, rendering critical data inaccessible until a ransom is paid. Organizations in all sectors that utilize Azure Storage Accounts are potentially vulnerable. The compromise can allow attackers full control over the storage account leading to complete data loss.

Recommendation

  • Implement the Sigma rule "Azure Storage Account Keys Accessed by Privileged User - New Access" to detect first-time key access within 7 days by privileged users based on azure.activitylogs.operation_name: "MICROSOFT.STORAGE/STORAGEACCOUNTS/LISTKEYS/ACTION" and event.outcome: "success".
  • Enable Azure Activity Logs and ensure they are being ingested into your SIEM to provide the data source necessary for the provided Sigma rules.
  • Rotate storage account keys immediately upon detection of unauthorized access and audit recent activities on the affected storage accounts.
  • Enforce the use of Azure AD authentication or SAS tokens instead of storage account keys to reduce future risks, as recommended by Microsoft.
  • Review and restrict the assignment of high-privilege roles like Owner and Contributor, following the principle of least privilege.
  • Configure Azure Policy to restrict the listKeys operation to specific roles or require additional approval workflows.
]]>mediumthreatazurestorage accountcredential accessransomwareAzure Storage Account Key Regenerationhttps://feed.craftedsignal.io/briefs/2024-01-04-azure-storage-key-regen/Thu, 04 Jan 2024 15:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-04-azure-storage-key-regen/Detection of Azure Storage Account key regeneration events, which can signify potential credential access or persistence attempts by adversaries aiming to gain unauthorized access or disrupt services.This threat brief focuses on the detection of Azure Storage Account key regeneration events. Regenerating these keys can impact dependent applications and Azure services. An adversary might regenerate a storage account key to gain unauthorized access to storage resources, potentially leading to data exfiltration or service disruption. The detection rule monitors Azure activity logs for successful key regeneration operations, providing an opportunity to identify and respond to potential credential misuse. Key rotation is a normal part of operations, however, unscheduled key rotation, or key rotation from unfamiliar locations or users should be investigated.

Attack Chain

  1. An adversary gains initial access to an Azure account, potentially through compromised credentials or exploiting a vulnerability.
  2. The adversary enumerates existing Azure storage accounts within the compromised subscription to identify potential targets.
  3. The adversary authenticates to the Azure Resource Manager API using the compromised credentials or an established session.
  4. The adversary executes a command to regenerate a storage account access key using the Azure CLI or PowerShell.
  5. Azure Activity Logs record the event with operation_name as MICROSOFT.STORAGE/STORAGEACCOUNTS/REGENERATEKEY/ACTION and event.outcome as Success.
  6. If successful, the adversary can then use the newly generated key to access the storage account and its contents.
  7. The adversary attempts to access or download sensitive data stored within the Azure Storage Account, such as backups or proprietary files.
  8. The adversary establishes persistence by using the new keys in automated scripts to access data in the storage account.

Impact

Successful regeneration of Azure Storage Account keys can lead to unauthorized access to sensitive data, including customer information, proprietary data, and backups. This can result in data breaches, financial loss, and reputational damage. The scope of the impact depends on the permissions associated with the compromised account and the sensitivity of the data stored in the affected storage account.

Recommendation

  • Deploy the Sigma rule "Azure Storage Account Key Regenerated" to your SIEM to detect unauthorized key regenerations in Azure Activity Logs.
  • Investigate any detected instances of storage account key regeneration, especially those performed by unfamiliar users or from unusual locations, by examining the event.outcome and associated user activity logs.
  • Implement multi-factor authentication (MFA) for all Azure accounts to reduce the risk of credential compromise, mitigating initial access (TA0001).
  • Review and harden Azure Storage Account access policies and permissions to adhere to the principle of least privilege, limiting the impact of potential credential compromise (T1552).
  • Establish a process for regular, documented key rotation and create exceptions in the detection rule for these known events.
]]>lowadvisoryazurecredential-accessstorage-account