Run any Skill in Manus with one click

detecting-azure-storage-account-misconfigurations

Stars21

Forks1

UpdatedJuly 3, 2026 at 14:43

Audit Azure Blob and ADLS storage accounts for public access exposure, weak or long-lived SAS tokens, missing encryption at rest, disabled HTTPS-only traffic, and outdated TLS versions using the azure-mgmt-storage Python SDK.

Installation

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

Run Skill in Manus

Source

theheavenlyd3mon

theheavenlyd3mon/hermes-profiles

View GitHub Repository View Creator Repositories

Download

Run Skill in Manus

Related occupationsSOC

Based on SOC occupation classification

Information Security AnalystsComputer and Mathematical Occupations·SOC 15-1212

File Explorer

4 files

SKILL.md

readonly

name	detecting-azure-storage-account-misconfigurations
description	Audit Azure Blob and ADLS storage accounts for public access exposure, weak or long-lived SAS tokens, missing encryption at rest, disabled HTTPS-only traffic, and outdated TLS versions using the azure-mgmt-storage Python SDK.
domain	cybersecurity
subdomain	cloud-security
tags	["Azure","storage-accounts","blob-storage","ADLS","SAS-tokens","encryption","public-access","cloud-misconfiguration","azure-mgmt-storage"]
version	1.0
author	mahipal
license	Apache-2.0
nist_ai_rmf	["MEASURE-2.7","MAP-5.1","MANAGE-2.4"]
atlas_techniques	["AML.T0070","AML.T0066","AML.T0082"]
nist_csf	["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"]

Detecting Azure Storage Account Misconfigurations

Overview

Azure Storage accounts are a frequent target for attackers due to misconfigured public access, long-lived SAS tokens, missing encryption, and outdated TLS versions. This skill uses the azure-mgmt-storage Python SDK with StorageManagementClient to enumerate all storage accounts in a subscription, inspect their security properties, list blob containers for public access settings, and generate a risk-scored audit report identifying critical misconfigurations.

When to Use

When investigating security incidents that require detecting azure storage account misconfigurations
When building detection rules or threat hunting queries for this domain
When SOC analysts need structured procedures for this analysis type
When validating security monitoring coverage for related attack techniques

Prerequisites

Python 3.9+ with azure-mgmt-storage, azure-identity
Azure service principal with Reader role on target subscription
Environment variables: AZURE_CLIENT_ID, AZURE_TENANT_ID, AZURE_CLIENT_SECRET, AZURE_SUBSCRIPTION_ID

Key Detection Areas

Public blob access — allow_blob_public_access enabled on storage account or individual containers set to Blob/Container access level
HTTPS enforcement — enable_https_traffic_only disabled, allowing unencrypted HTTP traffic
Minimum TLS version — accounts accepting TLS 1.0 or TLS 1.1 instead of minimum TLS 1.2
Encryption at rest — storage service encryption not enabled or missing customer-managed keys
Network rules — default action set to Allow instead of Deny, exposing storage to all networks
SAS token risks — account-level SAS with overly broad permissions or excessive lifetime

Output

JSON report with per-account findings, severity ratings (Critical/High/Medium/Low), and remediation recommendations aligned with CIS Azure Benchmark controls.

More from this repository

same repository

auditing-aws-s3-bucket-permissions

theheavenlyd3mon/hermes-profiles

Systematically audit AWS S3 bucket permissions to identify publicly accessible buckets, overly permissive ACLs, misconfigured bucket policies, and missing encryption settings using AWS CLI, S3audit, and Prowler to enforce least-privilege data access controls.

2026-07-0321

auditing-azure-active-directory-configuration

theheavenlyd3mon/hermes-profiles

Auditing Microsoft Entra ID (Azure Active Directory) configuration to identify risky authentication policies, overly permissive role assignments, stale accounts, conditional access gaps, and guest user risks using AzureAD PowerShell, Microsoft Graph API, and ScoutSuite.

2026-07-0321

auditing-cloud-with-cis-benchmarks

theheavenlyd3mon/hermes-profiles

This skill details how to conduct cloud security audits using Center for Internet Security benchmarks for AWS, Azure, and GCP. It covers interpreting CIS Foundations Benchmark controls, running automated assessments with tools like Prowler and ScoutSuite, remediating failed controls, and maintaining continuous compliance monitoring against CIS v5 for AWS, v4 for Azure, and v4 for GCP.

2026-07-0321

auditing-gcp-iam-permissions

theheavenlyd3mon/hermes-profiles

Auditing Google Cloud Platform IAM permissions to identify overly permissive bindings, primitive role usage, service account key proliferation, and cross-project access risks using gcloud CLI, Policy Analyzer, and IAM Recommender.

2026-07-0321

auditing-kubernetes-cluster-rbac

theheavenlyd3mon/hermes-profiles

Auditing Kubernetes cluster RBAC configurations to identify overly permissive roles, wildcard permissions, dangerous ClusterRoleBindings, service account abuse, and privilege escalation paths using kubectl, rbac-tool, KubiScan, and Kubeaudit.

2026-07-0321

auditing-terraform-infrastructure-for-security

theheavenlyd3mon/hermes-profiles

Auditing Terraform infrastructure-as-code for security misconfigurations using Checkov, tfsec, Terrascan, and OPA/Rego policies to detect overly permissive IAM policies, public resource exposure, missing encryption, and insecure defaults before cloud deployment.

2026-07-0321

name	detecting-azure-storage-account-misconfigurations
description	Audit Azure Blob and ADLS storage accounts for public access exposure, weak or long-lived SAS tokens, missing encryption at rest, disabled HTTPS-only traffic, and outdated TLS versions using the azure-mgmt-storage Python SDK.
domain	cybersecurity
subdomain	cloud-security
tags	["Azure","storage-accounts","blob-storage","ADLS","SAS-tokens","encryption","public-access","cloud-misconfiguration","azure-mgmt-storage"]
version	1.0
author	mahipal
license	Apache-2.0
nist_ai_rmf	["MEASURE-2.7","MAP-5.1","MANAGE-2.4"]
atlas_techniques	["AML.T0070","AML.T0066","AML.T0082"]
nist_csf	["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"]

Detecting Azure Storage Account Misconfigurations

Overview

When to Use

When investigating security incidents that require detecting azure storage account misconfigurations
When building detection rules or threat hunting queries for this domain
When SOC analysts need structured procedures for this analysis type
When validating security monitoring coverage for related attack techniques

Prerequisites

Python 3.9+ with azure-mgmt-storage, azure-identity
Azure service principal with Reader role on target subscription
Environment variables: AZURE_CLIENT_ID, AZURE_TENANT_ID, AZURE_CLIENT_SECRET, AZURE_SUBSCRIPTION_ID

Key Detection Areas

Public blob access — allow_blob_public_access enabled on storage account or individual containers set to Blob/Container access level
HTTPS enforcement — enable_https_traffic_only disabled, allowing unencrypted HTTP traffic
Minimum TLS version — accounts accepting TLS 1.0 or TLS 1.1 instead of minimum TLS 1.2
Encryption at rest — storage service encryption not enabled or missing customer-managed keys
Network rules — default action set to Allow instead of Deny, exposing storage to all networks
SAS token risks — account-level SAS with overly broad permissions or excessive lifetime

Output

JSON report with per-account findings, severity ratings (Critical/High/Medium/Low), and remediation recommendations aligned with CIS Azure Benchmark controls.