LoFP / intentionally public containers (static websites, public datasets) generate anonymous getblob and listblobs. baseline those storage accounts and exclude `azure.resource.id` after review.

Techniques

• T1530
• T1580

Sample rules

Azure Storage Anonymous Blob Access to Unusual Resource

• source: elastic
• technicques:
  • T1530
  • T1580

Description

Identifies the first time an Azure Storage resource receives an anonymous data-plane read (GetBlob and related Get or List operations). Anonymous requests are used to probe public containers and to test stolen blob URLs before a SAS is appended. First-seen resource ID keeps volume down while still covering WireServer-related probes of status or extension blobs.

Detection logic

data_stream.dataset: azure.platformlogs and
    azure.platformlogs.identity.type: Anonymous and
    event.action: (
        GetBlob or GetBlobMetadata or GetBlobProperties or GetBlockList or
        GetPageRanges or QueryBlobContents or ListBlobs or
        GetContainerProperties or GetContainerMetadata or GetContainerAcl
    )