Analytics Alerts

Browse the Cortex analytics alert reference.

Severity ▾
Detection module ▾
Data source ▾

2 alerts match the current filters.

Download CSV Show ATT&CK heatmap
  • An Azure VM snapshot SAS URL was generated Informational Cloud 1 variation

    An identity generated a SAS URL for an Azure VM snapshot. SAS URLs allow others to download or export the snapshot.

    Activation:
    14 Days
    Training:
    30 Days
    Test:
    N/A (single event)
    Deduplication:
    1 Day
    ATT&CK tactics: Exfiltration (TA0010)
    ATT&CK techniques: Transfer Data to Cloud Account (T1537)
    Required data: Azure Audit Log
    Detector tags: Data Detection & Response, Cloud Data Asset Exfiltration
    Attacker's goals: Exfiltrate the VM disk image to access sensitive data stored on the disk.
    Investigative actions: Verify if the identity is authorized to generate SAS URLs for VM snapshots. Check if the snapshot export aligns with scheduled maintenance or backup procedures. Review further actions performed by the identity to see if the snapshot was downloaded or accessed. Check whether the identity has generated SAS URLs for other Azure VM snapshots.

    Variations

    An identity generated a SAS URL for an Azure VM snapshot with unusual characteristics

    Low overridden

    An identity generated a SAS URL for an Azure VM snapshot. SAS URLs allow others to download or export the snapshot. overridden

  • An Azure VM snapshot SAS URL was generated for export from a production subscription Informational Cloud

    A SAS URL for an Azure VM snapshot was generated. The operation was performed within a production subscription. SAS URLs allow others to download or export the snapshot.

    Activation:
    14 Days
    Training:
    30 Days
    Test:
    N/A (single event)
    Deduplication:
    1 Day
    ATT&CK tactics: Exfiltration (TA0010)
    ATT&CK techniques: Transfer Data to Cloud Account (T1537)
    Required data: Azure Audit Log
    Detector tags: Data Detection & Response, Cloud Data Asset Exfiltration
    Attacker's goals: Exfiltrate the VM disk image to access sensitive data stored on the disk.
    Investigative actions: Verify if the identity is authorized to generate SAS URLs for VM snapshots. Check if the snapshot export aligns with scheduled maintenance or backup procedures. Review further actions performed by the identity to see if the snapshot was downloaded or accessed.