菜单
Detect abnormal access patterns in Azure Blob Storage by analyzing Storage Analytics and diagnostic logs. Identifies after-hours bulk downloads, access from new IP addresses, unusual API calls (GetBlob spikes), and potential data exfiltration.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Identifies and remediates non-quantum-safe cryptographic configurations in Azure including classical TLS key exchange, RSA and ECC keys in Key Vault, and classical certificate algorithms. Maps findings to NIST PQC standards FIPS 203, FIPS 204, and FIPS 205. Use when assessing quantum readiness of Azure infrastructure or building a Cryptographic Bill of Materials.
Queries Azure Monitor activity logs and sign-in logs to detect suspicious administrative operations, impossible travel, and privilege escalation.
Auditing Microsoft Entra ID (Azure Active Directory) configuration to identify risky authentication policies, overly permissive role assignments, and guest user risks.
Conduct cloud security audits using Center for Internet Security (CIS) benchmarks for Azure. Covers interpreting CIS Foundations Benchmark controls, running automated assessments, and maintaining continuous compliance monitoring.
Deploy Microsoft Sentinel as a cloud-native SIEM and SOAR platform for Azure. Covers configuring data connectors (Entra ID, Azure Activity), writing KQL detection queries, and building automated response playbooks.
Establish SAML 2.0 identity federation between on-premises Active Directory and Microsoft Entra ID (Azure AD) for seamless cross-domain authentication and SSO.
| name | analyzing-cloud-storage-access-patterns |
| description | Detect abnormal access patterns in Azure Blob Storage by analyzing Storage Analytics and diagnostic logs. Identifies after-hours bulk downloads, access from new IP addresses, unusual API calls (GetBlob spikes), and potential data exfiltration. |
| domain | cybersecurity |
| subdomain | cloud-security |
| tags | ["storage","azure-blob","access-patterns","threat-hunting","cloud-security"] |
| version | 1.0 |
| author | openshield |
| license | Apache-2.0 |
| nist_csf | ["PR.DS-1","PR.DS-2","PR.DS-3","PR.AC-3","DE.CM-1","DE.CM-7","PR.IP-4"] |
| Term | Definition |
|---|---|
| Storage Analytics | Azure feature that provides logs and metrics for storage accounts |
| Diagnostic Settings | Configuration to send storage logs to Log Analytics or Event Hub |
| SAS Token | Shared Access Signature, providing temporary delegated access to storage |
| Data Exfiltration | Unauthorized transfer of data from a storage account to an external system |
| Rule | Description | Severity |
|---|---|---|
| AZ-STOR-001 | Public Blob Access Enabled on Storage Account | HIGH |
| AZ-STOR-004 | Storage Account Diagnostic Logging Disabled | MEDIUM |
| AZ-STOR-002 | Storage Account Allows HTTP Traffic | MEDIUM |
| AZ-STOR-003 | Storage Account Has No Lifecycle Management Policy | LOW |
Ensure logs are sent to Log Analytics and use KQL to identify spikes.
// Identify bulk GetBlob operations from a single IP
StorageBlobLogs
| where OperationName == "GetBlob"
| summarize RequestCount = count() by CallerIpAddress, bin(TimeGenerated, 1h)
| where RequestCount > 100
Monitor for access from new source IPs or unusual hours.
GetBlob or ListBlobs calls.403 Forbidden errors indicating enumeration.az storage account update --allow-blob-public-access false.az storage account update --https-only true.