LoFP LoFP / legitimate it operations and cloud administrators frequently use windows azure storage tools for data management and backups. investigate unexpected usage to rule out unauthorized access or exfiltration.

Techniques

Sample rules

Windows Azure Storage Utility Execution Via CLI

Description

This analytic detects the execution of Azure Storage utilities such as AzCopy and Storage Explorer via the CLI. These tools enable large-scale data transfers over trusted cloud channels, allowing malicious activity to blend with legitimate traffic and evade traditional network defenses. Adversaries may leverage them post-compromise to stage or extract sensitive data from endpoints. While legitimate administrative use is expected, anomalous execution patterns, unexpected users, or unusual parent processes should be treated as potential indicators of compromise and investigated promptly.

Detection logic


| tstats `security_content_summariesonly`
  count min(_time) as firstTime
        max(_time) as lastTime

from datamodel=Endpoint.Processes where

Processes.process_name IN (
    "AzCopy.exe",
    "StorageExplorer.exe"
)

by Processes.process Processes.vendor_product Processes.user_id
   Processes.process_hash Processes.parent_process_name
   Processes.parent_process_exec Processes.action Processes.dest
   Processes.process_current_directory Processes.process_path
   Processes.process_integrity_level Processes.original_file_name
   Processes.parent_process Processes.parent_process_path
   Processes.parent_process_guid Processes.parent_process_id
   Processes.process_guid Processes.process_id
   Processes.user Processes.process_name


| `drop_dm_object_name(Processes)`

| `security_content_ctime(firstTime)`

| `security_content_ctime(lastTime)`

| `windows_azure_storage_utility_execution_via_cli_filter`