Panther medium experimental python

Azure Storage Blob Container Permissions Modified

Detects when permissions are modified on an Azure Storage blob container. Adversaries may modify container permissions to enable public access, grant unauthorized access, or prepare for data exfiltration. Changes to blob permissions can indicate attempts to access sensitive data, establish persistence through external access, or facilitate ransomware by modifying access controls before encryption.

View Source

Detection Logic

from panther_azureactivity_helpers import (
    azure_activity_alert_context,
    azure_activity_success,
    extract_resource_name_from_id,
)

BLOB_PERMISSIONS_OPERATIONS = [
    "MICROSOFT.STORAGE/STORAGEACCOUNTS/BLOBSERVICES/CONTAINERS/WRITE",
]


def rule(event):
    return event.get(
        "operationName", ""
    ).upper() in BLOB_PERMISSIONS_OPERATIONS and azure_activity_success(event)


def title(event):
    resource_id = event.get("resourceId", "<UNKNOWN_RESOURCE>")

    container_name = extract_resource_name_from_id(
        resource_id, "containers", default="<UNKNOWN_CONTAINER>"
    )
    storage_account_name = extract_resource_name_from_id(
        resource_id, "storageAccounts", default="<UNKNOWN_STORAGE_ACCOUNT>"
    )

    return (
        f"Azure Storage Blob Container Modified: [{container_name}] " f"in [{storage_account_name}]"
    )


def alert_context(event):
    context = azure_activity_alert_context(event)
    return context

Field Validations

Loading…

Comments (0)

Loading comments...