An Azure VM snapshot SAS URL was generated for export from a production subscription

Analytics BIOC Informational

An Azure VM snapshot SAS URL was generated for export from a production subscription

A SAS URL for an Azure VM snapshot was generated. The operation was performed within a production subscription. SAS URLs allow others to download or export the snapshot.

Module:: Cortex Cloud
Licensed by:: Cloud Runtime Security (CRS)
Data source:: Azure Audit Log

ATT&CK tactics: Exfiltration (TA0010)

ATT&CK techniques: Transfer Data to Cloud Account (T1537)

Detector tags: Data Detection & Response Cloud Data Asset Exfiltration

Attacker's goals:

Exfiltrate the VM disk image to access sensitive data stored on the disk.

Investigative actions:

Verify if the identity is authorized to generate SAS URLs for VM snapshots. Check if the snapshot export aligns with scheduled maintenance or backup procedures. Review further actions performed by the identity to see if the snapshot was downloaded or accessed.

Test period:: N/A (single event)
Deduplication:: 1 Day