Azure Storage Bulk Download via AccountKey or SAS Token from External IP

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

Back to Content Index


Hunts for bulk Azure Blob Storage downloads authenticated with AccountKey or SAS tokens from external IPs, indicating potential credential abuse and silent data Exfiltration.

Attribute Value
Type Hunting Query
Solution Hybrid Attack - Cloud & Identity
ID eea3dc6d-7abd-465e-b8e8-5176c205bb8e
Tactics Exfiltration, Collection
Techniques T1530, T1041
Required Connectors AzureStorageAccount
Source View on GitHub

Tables Used

This content item queries data from the following tables:

Table Selection Criteria Transformations Ingestion API Lake-Only
StorageBlobLogs CallerIpAddress startswith "10."
CallerIpAddress startswith "127."
CallerIpAddress startswith "169.254."
CallerIpAddress startswith "172."
CallerIpAddress startswith "192.168."
StatusCode in "200,206"
UserAgentHeader contains "rubrik"

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

Back to Hunting Queries · Back to Hybrid Attack - Cloud & Identity