LoFP / it or devops using azcopy for authorized migrations on a host that has not used it in the history window.

Techniques

• T1059
• T1530
• T1567

Sample rules

AzCopy or Azure Storage Explorer Usage on Unusual Host

• source: elastic
• technicques:
  • T1059
  • T1530
  • T1567

Description

Identifies the first time, in a historical window, a host runs AzCopy copy or sync to Azure Blob, Data Lake, or File storage, or starts Azure Storage Explorer. These Microsoft utilities are legitimate data-transfer tools; ransomware and cloud-ransomware operators drop portable copies and use SAS-authenticated jobs to pull data from victim storage and push it to attacker-controlled accounts.

Detection logic

host.os.type:windows and event.category:process and event.type:start and
(
  (
    (process.name:"azcopy.exe" or process.pe.original_file_name:"azcopy.exe") and
    process.args:("copy" or "sync") and
    process.command_line:(*blob.core.windows.net* or *dfs.core.windows.net* or *file.core.windows.net* or *blob.storage.azure.net*)
  ) or
  process.name:("StorageExplorer.exe" or "StorageExplorer-windows-x64.exe" or "StorageExplorer-windows-arm64.exe" or "StorageExplorer-windowsx64.exe")
)