LoFP LoFP / false positives are expected from legitimate tooling. the detection excludes the azure cli bundled python interpreter, windows powershell, powershell 7+, vs code, and the azure developer cli by process path. residual false positives may arise from ci/cd agents (e.g., azure devops self-hosted runners, github actions runners) that invoke az or azure powershell from non-standard install paths not covered by the exclusion list, backup or dlp agents that scan user profile directories, and custom automation scripts that shell out to azure cli from an unexpected working directory. tune by adding confirmed-legitimate process paths and file paths to the companion filter macro windows_cloud_sensitive_file_read_access_by_uncommon_process_filter.

Techniques

Sample rules

Windows Cloud Sensitive File Read Access By Uncommon Process

Description

This analytic detects uncommon processes reading or requesting read access to sensitive files from cloud providers on Windows endpoints. It monitors Windows Security Event 4663 for ReadData (AccessMask 0x1) operations against sensitive files from cloud providers such as Azure. Access by any process outside the known toolchain may indicate credential theft or cloud identity reconnaissance activity, including infostealer behavior such as one observed in Vidar Stealer variants. This detection currently only supports Azure sensitive files, but will be extended to support other cloud providers in the future.

Detection logic

`wineventlog_security`
EventCode=4663
ObjectType="File"
NOT process_path IN (
    "*:\\AppData\\Local\\Programs\\Python\\*\\python.exe",
    "*:\\AppData\\Local\\Python\\bin\\python.exe",
    "*:\\AppData\\Local\\Python\\pythoncore-*\\python.exe",
    "*:\\Program Files\\Azure Dev CLI\\azd.exe",
    "*:\\Program Files\\Microsoft SDKs\\Azure\\CLI2\\python.exe",
    "*:\\Program Files\\Microsoft VS Code\\Code.exe",
    "*:\\Program Files\\nodejs\\node.exe",
    "*:\\Program Files\\PowerShell\\7-preview\\pwsh.exe",
    "*:\\Program Files\\PowerShell\\7\\pwsh.exe",
    "*:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe",
    "*:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe",
    "*\\.azd\\bin\\azd.exe",
    "*\\AppData\\Local\\Microsoft\\powershell\\pwsh.exe",
    "*\\AppData\\Local\\Programs\\Azure Dev CLI\\azd.exe",
    "*\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe"
)
ObjectName IN (
    "*\\.azure\\accessTokens.json",
    "*\\.azure\\azureProfile.json",
    "*\\.azure\\msal_token_cache.json",
    "*\\.azure\\TokenCache.dat",
    "*\\Windows Azure Powershell\\TokenCache.dat"
)

We select only read-related operations: 0x1 = ReadData (or ListDirectory)



| eval AccessMask_ = tonumber(AccessMask, 16)

| where (bit_and(AccessMask_, 1) != 0)


| stats count min(_time) as firstTime
              max(_time) as lastTime
  by signature_id signature
     ObjectType file_path file_name
     process_path process_name process_id
     AccessMask src_user dest


| `security_content_ctime(firstTime)`

| `security_content_ctime(lastTime)`

| `windows_cloud_sensitive_file_read_access_by_uncommon_process_filter`