Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊
"This Kusto (KQL) hunting query detects blob-enumeration or file-spraying behaviour in Azure Storage by: - Aggregating requests into time-bound sessions with row_window_session(). - Defining a "user" as the combination of AccountName | UserAgentHeader, which is tolerant of rapid IP rotation. - Raising an alert when, within any single session: - The actor touches at least 10 distinct objects, and - At least 50 % of those requests return an HTTP 4xx/5xx status, and - Each object is acc
| Attribute | Value |
|---|---|
| Type | Hunting Query |
| Solution | GitHub Only |
| ID | b7b409df-af7b-4feb-9cc9-109beed37512 |
| Tactics | Reconnaissance, Collection |
| Techniques | T1595, T1530 |
| Source | View on GitHub |
This content item queries data from the following tables:
| Table | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|
StorageBlobLogs |
✓ | ✗ | ? |
The following connectors provide data for this content item:
| Connector | Solution |
|---|---|
| AzureStorageAccount | Azure Storage |
Solutions: Azure Storage
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊