analyzing-cloud-storage-access-patterns

# Analyzing Cloud Storage Access Patterns — Azure Focused ## When to Use - When investigating potential data exfiltration from Azure Storage Accounts. - When building KQL hunting queries for Storage account activity. - When validating if access to sensitive blobs follows established baselines. - When performing security audits of Storage SAS token usage and public access. ## Key Concepts | Term | Definition | |------|------------| | Storage Analytics | Azure feature that provides logs and metrics for storage accounts | | Diagnostic Settings | Configuration to send storage logs to Log Analytics or Event Hub | | SAS Token | Shared Access Signature, providing temporary delegated access to storage | | Data Exfiltration | Unauthorized transfer of data from a storage account to an external system | ## OpenShield Storage Rules | Rule | Description | Severity | |------|-------------|----------| | AZ-STOR-001 | Public Blob Access Enabled on Storage Account | HIGH | | AZ-STOR-004 | Storage Account Diagnostic Logging Disabled | MEDIUM | | AZ-STOR-002 | Storage Account Allows HTTP Traffic | MEDIUM | | AZ-STOR-003 | Storage Account Has No Lifecycle Management Policy | LOW | ## Analysis Workflow ### Step 1: Enable and Query Diagnostic Logs Ensure logs are sent to Log Analytics and use KQL to identify spikes. ```kql // Identify bulk GetBlob operations from a single IP StorageBlobLogs | where OperationName == "GetBlob" | summarize RequestCount = count() by CallerIpAddress, bin(TimeGenerated, 1h) | where RequestCount > 100 ``` ### Step 2: Build Access Baselines Monitor for access from new source IPs or unusual hours. ### Step 3: Detect Anomalies - **Spikes**: Sudden increase in `GetBlob` or `ListBlobs` calls. - **Geography**: Access from IPs in countries where the organization does not operate. - **Success/Failure Ratio**: High number of `403 Forbidden` errors indicating enumeration. ## Remediation Reference - **Disable Public Access**: Use `az storage account update --allow-blob-public-access false`. - **Enforce HTTPS**: Use `az storage account update --https-only true`. - **Use Private Endpoints**: Restrict storage access to internal VNet traffic only.