Anvilogic high experimental spl
Azure Modify Storage Settings [splunk-azure]
Microsoft Azure Storage provides REST operations for working with Table/Blob/File service resources. Adversaries could modify things such as storage logging and metrics collection.
Detection Logic
`get_cloud_data` `get_cloud_data_azure` `get_cloud_data_storage` operationName IN(SetBlobServiceProperties,SetFileServiceProperties,SetTableServiceProperties)
| rex field=src_ip mode=sed max_match=0 "s/\:\d{1,5}//g"
| table _time, host, user, account, region, src_ip, http_user_agent, access_key, user, user_id, identity_type, role, event_name, event_category, cloud_service, request_parameters, response, mfa_enabled, permissions, identity, action, resource_id, object_id, keyword
| bin span=60s
| stats values(*) as * by _time, src_ipField Validations
Loading…
Comments (0)
Loading comments...