Identifies when the Azure role-based access control (Azure RBAC) permissions are modified for an Azure Blob. An adversary may modify the permissions on a blob to weaken their target’s security controls or an administrator may inadvertently modify the permissions, which could lead to data exposure or loss.
Rule type: query
Risk score: 47
Runs every: 5 minutes
Maximum alerts per execution: 100
- Continuous Monitoring
- Identity and Access
Added (Elastic Stack release): 7.16.0
Rule authors: Austin Songer
Rule license: Elastic License v2
Blob permissions may be modified by system administrators. Verify that the configuration change was expected. Exceptions can be added to this rule to filter expected behavior.
## Config The Azure Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
event.dataset:azure.activitylogs and azure.activitylogs.operation_name:( "MICROSOFT.STORAGE/STORAGEACC OUNTS/BLOBSERVICES/CONTAINERS/BLOBS/MANAGEOWNERSHIP/ACTION" or "M ICROSOFT.STORAGE/STORAGEACCOUNTS/BLOBSERVICES/CONTAINERS/BLOBS/MODIFYP ERMISSIONS/ACTION") and event.outcome:(Success or success)