LoFP / internet-wide scanners will produce first-seen anonymous access on newly created or newly logged accounts. confirm whether the account is meant to be public.

Techniques

• T1530
• T1580

Sample rules

Azure Storage Anonymous Blob Access to Unusual Resource

• source: elastic
• technicques:
  • T1530
  • T1580

Description

Identifies the first time an Azure Storage resource receives an anonymous data-plane read (GetBlob and related Get or List operations). Anonymous requests are used to probe public containers and to test stolen blob URLs before a SAS is appended. First-seen resource ID keeps volume down while still covering WireServer-related probes of status or extension blobs.

Detection logic

data_stream.dataset: azure.platformlogs and
    azure.platformlogs.identity.type: Anonymous and
    event.action: (
        GetBlob or GetBlobMetadata or GetBlobProperties or GetBlockList or
        GetPageRanges or QueryBlobContents or ListBlobs or
        GetContainerProperties or GetContainerMetadata or GetContainerAcl
    )