Analytics BIOC
Informational
✕
Azure storage account was publicly shared
Azure Storage Account network permissions modified to public, exposing data to any network and unauthorized identities.
- Module:
- Cortex Cloud
- Licensed by:
- Cloud Runtime Security (CRS)
- Data source:
- Azure Audit Log
ATT&CK tactics: Defense Evasion (TA0005)
ATT&CK techniques: Impair Defenses (T1562)
Detector tags: Cloud Data Asset Public Exposure Data Detection & Response
Attacker's goals:
Attackers want to maintain indirect control over the resource. Attackers intend to allow public access, making it harder to detect future activity. Attackers are constantly monitoring for public assets to steal sensitive information.
Investigative actions:
Check if the storage account should be accessed from all networks. Disable public network access if needed. Check if the identity performed additional malicious activity and restrict permissions for the identity if required.
- Test period:
- N/A (single event)
- Deduplication:
- 5 Days