Panther medium experimental python

Azure Storage Account Keys Listed

Detects when Azure Storage Account access keys are listed or retrieved. This operation returns the full access keys which could grant complete control over the storage account and all its data. Adversaries may list storage account keys to gain persistent access to blob containers, file shares, queues, and tables without needing to maintain their current permissions.

View Source

Detection Logic

from panther_azureactivity_helpers import (
    azure_activity_alert_context,
    azure_activity_success,
    extract_resource_name_from_id,
)

KEY_LIST_OPERATIONS = [
    "MICROSOFT.STORAGE/STORAGEACCOUNTS/LISTKEYS/ACTION",
]


def rule(event):
    return event.get("operationName", "").upper() in KEY_LIST_OPERATIONS and azure_activity_success(
        event
    )


def title(event):
    resource_id = event.get("resourceId", "")
    storage_account_name = extract_resource_name_from_id(
        resource_id, "storageAccounts", default="<UNKNOWN_STORAGE_ACCOUNT>"
    )

    return f"Azure Storage Account Keys Listed on [{storage_account_name}]"


def alert_context(event):
    context = azure_activity_alert_context(event)
    return context

Field Validations

Loading…

Comments (0)

Loading comments...