Analytics BIOC Informational
✕

Azure storage account blob anonymous access is enabled

It is possible to configure anonymous access to blobs within the storage account.

Module:
Cortex Cloud
Licensed by:
Cloud Runtime Security (CRS)
Data source:
Azure Audit Log
ATT&CK tactics: Defense Evasion (TA0005) Privilege Escalation (TA0004) Initial Access (TA0001)
ATT&CK techniques: Valid Accounts: Cloud Accounts (T1078.004)
Detector tags: Cloud Data Asset Exfiltration Cloud Data Asset Public Exposure Data Detection & Response
Attacker's goals:

The attacker wants to maintain indirect control over the resource. Attackers intend to allow public access, making it harder to detect future activity. Attackers are constantly monitoring for public assets to steal sensitive information.

Investigative actions:

Check if the blobs within the storage account should be accessed from all networks. Disable public network access or disable blob anonymous access to storage account if needed. Check if the identity performed additional malicious activity and restrict permissions for the identity if required.

Test period:
N/A (single event)
Deduplication:
5 Days