Analytics BIOC
Informational
✕
An Azure VM snapshot SAS URL was generated
An identity generated a SAS URL for an Azure VM snapshot. SAS URLs allow others to download or export the snapshot.
- Module:
- Cortex Cloud
- Licensed by:
- Cloud Runtime Security (CRS)
- Data source:
- Azure Audit Log
ATT&CK tactics: Exfiltration (TA0010)
ATT&CK techniques: Transfer Data to Cloud Account (T1537)
Detector tags: Data Detection & Response Cloud Data Asset Exfiltration
Attacker's goals:
Exfiltrate the VM disk image to access sensitive data stored on the disk.
Investigative actions:
Verify if the identity is authorized to generate SAS URLs for VM snapshots. Check if the snapshot export aligns with scheduled maintenance or backup procedures. Review further actions performed by the identity to see if the snapshot was downloaded or accessed. Check whether the identity has generated SAS URLs for other Azure VM snapshots.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Day
1 variation:
- An identity generated a SAS URL for an Azure VM snapshot with unusual characteristics Low (parent: Informational)