Azure Storage Azure-Microsoft.Storage

operationName	Description	Sample	Rule
any	Catch-all for Azure-Microsoft.Storage rules that match the resource provider but no specific operation.	N	N
Microsoft.Storage/locations/ActionsRPOperationStatuses/write	Creates or updates an ActionsRP operation status	N	N
Microsoft.Storage/locations/DataManagementRPOperationStatuses/write	Creates or updates a DataManagamentRP operation status	N	N
Microsoft.Storage/locations/deleteVirtualNetworkOrSubnets/action	Notifies Microsoft.Storage that virtual network or subnet is being deleted	N	N
Microsoft.Storage/locations/notifyNetworkSecurityPerimeterUpdatesAvailable/action		N	N
Microsoft.Storage/locations/previewActions/action		N	N
Microsoft.Storage/register/action	Registers the subscription for the storage resource provider and enables the creation of storage accounts.	N	N
Microsoft.Storage/storageAccounts/accountLocks/delete		N	N
Microsoft.Storage/storageAccounts/accountLocks/deleteLock/action		N	N
Microsoft.Storage/storageAccounts/accountLocks/write		N	N
Microsoft.Storage/storageAccounts/accountMigrations/write	Customer is able to update their storage account redundancy for increased resiliency	N	N
Microsoft.Storage/storageAccounts/advancedPlatformMetrics/delete		N	N
Microsoft.Storage/storageAccounts/advancedPlatformMetrics/write		N	N
Microsoft.Storage/storageAccounts/blobServices/containers/clearLegalHold/action	Clear blob container legal hold	N	N
Microsoft.Storage/storageAccounts/blobServices/containers/delete	Returns the result of deleting a container	N	N
Microsoft.Storage/storageAccounts/blobServices/containers/getAcl/action		N	N
Microsoft.Storage/storageAccounts/blobServices/containers/immutabilityPolicies/delete	Delete blob container immutability policy	N	Y
Microsoft.Storage/storageAccounts/blobServices/containers/immutabilityPolicies/extend/action	Extend blob container immutability policy	N	N
Microsoft.Storage/storageAccounts/blobServices/containers/immutabilityPolicies/lock/action	Lock blob container immutability policy	N	N
Microsoft.Storage/storageAccounts/blobServices/containers/immutabilityPolicies/write	Put blob container immutability policy	N	N
Microsoft.Storage/storageAccounts/blobServices/containers/lease/action	Returns the result of leasing blob container	N	N
Microsoft.Storage/storageAccounts/blobServices/containers/migrate/action		N	N
Microsoft.Storage/storageAccounts/blobServices/containers/setAcl/action		N	N
Microsoft.Storage/storageAccounts/blobServices/containers/setLegalHold/action	Set blob container legal hold	N	N
Microsoft.Storage/storageAccounts/blobServices/containers/write	Returns the result of patch blob container	N	Y
Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action	Returns a user delegation key for the blob service	N	N
Microsoft.Storage/storageAccounts/blobServices/getInfo/action		N	N
Microsoft.Storage/storageAccounts/blobServices/providers/Microsoft.Insights/diagnosticSettings/write	Creates or updates the diagnostic setting for the resource.	N	N
Microsoft.Storage/storageAccounts/blobServices/write	Returns the result of put blob service properties	N	Y
Microsoft.Storage/storageAccounts/connectors/delete	Delete a storage connector.	N	N
Microsoft.Storage/storageAccounts/connectors/testExistingConnection/action	Test the connection of an existing storage connector.	N	N
Microsoft.Storage/storageAccounts/connectors/write	Creates or updates a storage connector.	N	N
Microsoft.Storage/storageAccounts/consumerDataShare/action		N	N
Microsoft.Storage/storageAccounts/consumerDataSharePolicies/write		N	N
Microsoft.Storage/storageAccounts/dataSharePolicies/delete		N	N
Microsoft.Storage/storageAccounts/dataSharePolicies/write		N	N
Microsoft.Storage/storageAccounts/dataShares/delete	Delete a storage data share.	N	N
Microsoft.Storage/storageAccounts/dataShares/write	Creates or updates a storage data share.	N	N
Microsoft.Storage/storageAccounts/delete	Deletes an existing storage account.	Y	Y
Microsoft.Storage/storageAccounts/encryptionScopes/hoboConfigurations/write		N	N
Microsoft.Storage/storageAccounts/encryptionScopes/write		N	N
Microsoft.Storage/storageAccounts/failover/action	Customer is able to control the failover in case of availability issues	N	N
Microsoft.Storage/storageAccounts/fileServices/generateUserDelegationKey/action	Returns a user delegation key for the file service	N	N
Microsoft.Storage/storageAccounts/fileServices/providers/Microsoft.Insights/diagnosticSettings/write	Creates or updates the diagnostic setting for the resource.	N	N
Microsoft.Storage/storageAccounts/fileServices/shares/delete	Delete file share	N	N
Microsoft.Storage/storageAccounts/fileServices/shares/lease/action		N	N
Microsoft.Storage/storageAccounts/fileServices/shares/restore/action	Restore file share	N	N
Microsoft.Storage/storageAccounts/fileServices/shares/revert/action	Revert File Share	N	N
Microsoft.Storage/storageAccounts/fileServices/shares/write	Create or update file share	N	Y
Microsoft.Storage/storageAccounts/fileServices/write	Put file service properties	N	N
Microsoft.Storage/storageAccounts/hnsonmigration/action	Customer is able to migrate to hns account type	N	N
Microsoft.Storage/storageAccounts/hoboConfigurations/write		N	N
Microsoft.Storage/storageAccounts/inventoryPolicies/delete		N	N
Microsoft.Storage/storageAccounts/inventoryPolicies/write		N	N
Microsoft.Storage/storageAccounts/joinPerimeter/action	Access check for joining Network Security Perimeter	N	N
Microsoft.Storage/storageAccounts/listAccountSas/action	Returns the Account SAS token for the specified storage account.	N	N
Microsoft.Storage/storageAccounts/listkeys/action	Returns the access keys for the specified storage account.	Y	Y
Microsoft.Storage/storageAccounts/listServiceSas/action	Returns the Service SAS token for the specified storage account.	N	N
Microsoft.Storage/storageAccounts/localUsers/delete	Delete local user	N	N
Microsoft.Storage/storageAccounts/localusers/listKeys/action	List local user keys	N	N
Microsoft.Storage/storageAccounts/localusers/regeneratePassword/action		N	N
Microsoft.Storage/storageAccounts/localUsers/regenerateSharedKey/action		N	N
Microsoft.Storage/storageAccounts/localusers/write	Create or update local user	N	N
Microsoft.Storage/storageAccounts/managementPolicies/delete	Delete storage account management policies	N	N
Microsoft.Storage/storageAccounts/managementPolicies/write	Put storage account management policies	N	N
Microsoft.Storage/storageAccounts/networkSecurityPerimeterAssociationProxies/delete		N	N
Microsoft.Storage/storageAccounts/networkSecurityPerimeterAssociationProxies/write		N	N
Microsoft.Storage/storageAccounts/networkSecurityPerimeterConfigurations/action		N	N
Microsoft.Storage/storageAccounts/objectReplicationPolicies/delete	Delete object replication policy	N	N
Microsoft.Storage/storageAccounts/objectReplicationPolicies/restorePointMarkers/write	Create object replication restore point marker	N	N
Microsoft.Storage/storageAccounts/objectReplicationPolicies/write	Create or update object replication policy	N	N
Microsoft.Storage/storageAccounts/privateEndpointConnectionProxies/delete	Delete Private Endpoint Connection Proxies	N	N
Microsoft.Storage/storageAccounts/privateEndpointConnectionProxies/updatePrivateEndpointProperties/action	Update storage account private endpoint properties	N	N
Microsoft.Storage/storageAccounts/privateEndpointConnectionProxies/validate/action	Validate Private Endpoint Connection Proxies	N	N
Microsoft.Storage/storageAccounts/privateEndpointConnectionProxies/write	Put Private Endpoint Connection Proxies	N	N
Microsoft.Storage/storageAccounts/privateEndpointConnections/delete	Delete Private Endpoint Connection	N	N
Microsoft.Storage/storageAccounts/privateEndpointConnections/write	Put Private Endpoint Connection	N	N
Microsoft.Storage/storageAccounts/PrivateEndpointConnectionsApproval/action	Approve Private Endpoint Connections	N	N
Microsoft.Storage/storageAccounts/privateEndpoints/move/action		N	N
Microsoft.Storage/storageAccounts/providers/Microsoft.Insights/diagnosticSettings/write	Creates or updates the diagnostic setting for the resource.	N	N
Microsoft.Storage/storageAccounts/queueServices/generateUserDelegationKey/action	Returns a user delegation key for the queue service	N	N
Microsoft.Storage/storageAccounts/queueServices/providers/Microsoft.Insights/diagnosticSettings/write	Creates or updates the diagnostic setting for the resource.	N	N
Microsoft.Storage/storageAccounts/queueServices/queues/delete	Returns the result of deleting a queue	N	N
Microsoft.Storage/storageAccounts/queueServices/queues/getAcl/action	Returns the result of processing a message	N	N
Microsoft.Storage/storageAccounts/queueServices/queues/setAcl/action	Returns the result of processing a message	N	N
Microsoft.Storage/storageAccounts/queueServices/queues/write	Returns the result of writing a queue	N	N
Microsoft.Storage/storageAccounts/queueServices/write	Returns the result of setting queue service properties	N	N
Microsoft.Storage/storageAccounts/regeneratekey/action	Regenerates the access keys for the specified storage account.	Y	Y
Microsoft.Storage/storageAccounts/restoreBlobRanges/action	Restore blob ranges to the state of the specified time	N	N
Microsoft.Storage/storageAccounts/restorePoints/delete	Delete object replication restore point	N	N
Microsoft.Storage/storageAccounts/revokeUserDelegationKeys/action	Revokes all the user delegation keys for the specified storage account.	N	N
Microsoft.Storage/storageAccounts/rotateKey/action		N	N
Microsoft.Storage/storageAccounts/services/diagnosticSettings/write	Create/Update storage account diagnostic settings.	N	N
Microsoft.Storage/storageAccounts/storageTaskAssignments/delete		N	N
Microsoft.Storage/storageAccounts/storageTaskAssignments/write		N	N
Microsoft.Storage/storageAccounts/tableServices/generateUserDelegationKey/action	Returns a user delegation key for the table service	N	N
Microsoft.Storage/storageAccounts/tableServices/providers/Microsoft.Insights/diagnosticSettings/write	Creates or updates the diagnostic setting for the resource.	N	N
Microsoft.Storage/storageAccounts/tableServices/tables/delete	Delete tables	N	N
Microsoft.Storage/storageAccounts/tableServices/tables/getAcl/action	Merge or update table entities	N	N
Microsoft.Storage/storageAccounts/tableServices/tables/setAcl/action	Merge or update table entities	N	N
Microsoft.Storage/storageAccounts/tableServices/tables/write	Create tables	N	N
Microsoft.Storage/storageAccounts/tableServices/write	Set table service properties	N	N
Microsoft.Storage/storageAccounts/updateAccountContainerHoldingPeriod/action		N	N
Microsoft.Storage/storageAccounts/updateAutoRotateUserKeys/action		N	N
Microsoft.Storage/storageAccounts/updateInternalProperties/action		N	N
Microsoft.Storage/storageAccounts/write	Creates a storage account with the specified parameters or update the properties or tags or adds custom domain for the specified storage account.	Y	Y
Microsoft.Storage/storageTasks/delete	Deletes an existing storage task	N	N
Microsoft.Storage/storageTasks/promote/action	Promote specific version of storage task to current version	N	N
Microsoft.Storage/storageTasks/write	Creates or updates storage task	N	N
Microsoft.Storage/unregister/action		N	N
Microsoft.Storage/contextCaches/contextCacheContainers/delete	Delete a container from a Context Cache resource.	N	N
Microsoft.Storage/contextCaches/contextCacheContainers/write	Create or update a container in a Context Cache resource.	N	N
Microsoft.Storage/contextCaches/delete	Delete a Context Cache resource.	N	N
Microsoft.Storage/contextCaches/write	Create or update a Context Cache resource.	N	N
Microsoft.Storage/locations/ContextCacheRPOperationStatuses/write	Writes the status of an asynchronous Context Cache operation.	N	N
Microsoft.Storage/storageAccounts/abortHnsOnMigration/action	Customer is able to abort an ongoing Hns migration on the storage account	N	N
Microsoft.Storage/storageAccounts/encryptionScopes/sharedIdentities/write	Put shared identity for a storage account's encryption scope	N	N
Microsoft.Storage/storageAccounts/sharedIdentities/write		N	N

any: Azure Storage (catch-all)

Namespace: Microsoft.Storage

Description

Catch-all for Azure-Microsoft.Storage rules that match the resource provider but no specific operation.

Microsoft.Storage/locations/ActionsRPOperationStatuses/write

Namespace: Microsoft.Storage

Description

Creates or updates an ActionsRP operation status

Microsoft.Storage/locations/DataManagementRPOperationStatuses/write

Namespace: Microsoft.Storage

Description

Creates or updates a DataManagamentRP operation status

Microsoft.Storage/locations/deleteVirtualNetworkOrSubnets/action

Namespace: Microsoft.Storage

Description

Notifies Microsoft.Storage that virtual network or subnet is being deleted

Microsoft.Storage/locations/notifyNetworkSecurityPerimeterUpdatesAvailable/action

Namespace: Microsoft.Storage

Microsoft.Storage/locations/previewActions/action

Namespace: Microsoft.Storage

Microsoft.Storage/register/action

Namespace: Microsoft.Storage

Description

Registers the subscription for the storage resource provider and enables the creation of storage accounts.

Microsoft.Storage/storageAccounts/accountLocks/delete

Namespace: Microsoft.Storage

Microsoft.Storage/storageAccounts/accountLocks/deleteLock/action

Namespace: Microsoft.Storage

Microsoft.Storage/storageAccounts/accountLocks/write

Namespace: Microsoft.Storage

Microsoft.Storage/storageAccounts/accountMigrations/write

Namespace: Microsoft.Storage

Description

Customer is able to update their storage account redundancy for increased resiliency

Microsoft.Storage/storageAccounts/advancedPlatformMetrics/delete

Namespace: Microsoft.Storage

Microsoft.Storage/storageAccounts/advancedPlatformMetrics/write

Namespace: Microsoft.Storage

Microsoft.Storage/storageAccounts/blobServices/containers/clearLegalHold/action

Namespace: Microsoft.Storage

Description

Clear blob container legal hold

Microsoft.Storage/storageAccounts/blobServices/containers/delete

Namespace: Microsoft.Storage

Description

Returns the result of deleting a container

Microsoft.Storage/storageAccounts/blobServices/containers/getAcl/action

Namespace: Microsoft.Storage

Microsoft.Storage/storageAccounts/blobServices/containers/immutabilityPolicies/delete

Namespace: Microsoft.Storage

Description

Delete blob container immutability policy

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Panther #

Azure Storage Immutability Policy Deleted source high: Detects deletion of Azure Storage immutability policies that provide WORM protection. Storm-0501 ransomware operators delete these policies before encrypting data, as WORM-protected blobs cannot be modified even by administrators. Critical pre-ransomware indicator.T1485, T1490, T1562, T1562.001

Microsoft.Storage/storageAccounts/blobServices/containers/immutabilityPolicies/extend/action

Namespace: Microsoft.Storage

Description

Extend blob container immutability policy

Microsoft.Storage/storageAccounts/blobServices/containers/immutabilityPolicies/lock/action

Namespace: Microsoft.Storage

Description

Lock blob container immutability policy

Microsoft.Storage/storageAccounts/blobServices/containers/immutabilityPolicies/write

Namespace: Microsoft.Storage

Description

Put blob container immutability policy

Microsoft.Storage/storageAccounts/blobServices/containers/lease/action

Namespace: Microsoft.Storage

Description

Returns the result of leasing blob container

Microsoft.Storage/storageAccounts/blobServices/containers/migrate/action

Namespace: Microsoft.Storage

Microsoft.Storage/storageAccounts/blobServices/containers/setAcl/action

Namespace: Microsoft.Storage

Microsoft.Storage/storageAccounts/blobServices/containers/setLegalHold/action

Namespace: Microsoft.Storage

Description

Set blob container legal hold

Microsoft.Storage/storageAccounts/blobServices/containers/write

Namespace: Microsoft.Storage

Description

Returns the result of patch blob container

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`resultType` (panther rule field)	in	`Succeeded`	2 rules	panther
`resultType` (panther rule field)	in	`Success`	2 rules	panther

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

Azure Blob Storage Container Access Level Modified source low: Identifies changes to container access levels in Azure. Anonymous public read access to containers and blobs in Azure is a way to share data broadly, but can present a security risk if access to sensitive data is not managed judiciously.T1222, T1537, T1619

Panther #

Azure Storage Blob Anonymous Access Enabled source high: Detects when Azure storage account blob anonymous access is enabled at the account level or when container public access is configured. Enabling anonymous access allows unauthenticated users to read blob data and may lead to data exposure.T1530↳ also matches Microsoft.Storage/storageAccounts/blobServices/write, Microsoft.Storage/storageAccounts/write
Azure Storage Blob Container Permissions Modified source medium: Detects when permissions are modified on an Azure Storage blob container. Adversaries may modify container permissions to enable public access, grant unauthorized access, or prepare for data exfiltration. Changes to blob permissions can indicate attempts to access sensitive data, establish persistence through external access, or facilitate ransomware by modifying access controls before encryption.T1222, T1567.002

Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action

Namespace: Microsoft.Storage

Description

Returns a user delegation key for the blob service

Microsoft.Storage/storageAccounts/blobServices/getInfo/action

Namespace: Microsoft.Storage

Microsoft.Storage/storageAccounts/blobServices/providers/Microsoft.Insights/diagnosticSettings/write

Namespace: Microsoft.Storage

Description

Creates or updates the diagnostic setting for the resource.

Microsoft.Storage/storageAccounts/blobServices/write

Namespace: Microsoft.Storage

Description

Returns the result of put blob service properties

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`resultType` (panther rule field)	in	`Succeeded`	4 rules	panther
`resultType` (panther rule field)	in	`Success`	4 rules	panther

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Panther #

Azure Storage Account Blob Versioning Disabled source high: Detects when Azure storage account blob versioning is disabled. Disabling versioning removes protection against accidental deletion or modification and may indicate preparation for permanent data destruction.T1485
Azure Storage Blob Soft Delete Disabled source high: Detects when Azure storage account blob soft delete is disabled. Disabling soft delete removes protection against accidental deletion and may indicate preparation for data destruction.T1485, T1490
Azure Storage Container Soft Delete Disabled source high: Detects when Azure storage account container soft delete is disabled. Disabling container soft delete removes protection against accidental deletion and may indicate preparation for data destruction.T1485, T1490

Show 1 more (4 total) on the rules page

Microsoft.Storage/storageAccounts/connectors/delete

Namespace: Microsoft.Storage

Description

Delete a storage connector.

Microsoft.Storage/storageAccounts/connectors/testExistingConnection/action

Namespace: Microsoft.Storage

Description

Test the connection of an existing storage connector.

Microsoft.Storage/storageAccounts/connectors/write

Namespace: Microsoft.Storage

Description

Creates or updates a storage connector.

Microsoft.Storage/storageAccounts/consumerDataShare/action

Namespace: Microsoft.Storage

Microsoft.Storage/storageAccounts/consumerDataSharePolicies/write

Namespace: Microsoft.Storage

Microsoft.Storage/storageAccounts/dataSharePolicies/delete

Namespace: Microsoft.Storage

Microsoft.Storage/storageAccounts/dataSharePolicies/write

Namespace: Microsoft.Storage

Microsoft.Storage/storageAccounts/dataShares/delete

Namespace: Microsoft.Storage

Description

Delete a storage data share.

Microsoft.Storage/storageAccounts/dataShares/write

Namespace: Microsoft.Storage

Description

Creates or updates a storage data share.

Microsoft.Storage/storageAccounts/delete

Namespace: Microsoft.Storage

Description

Deletes an existing storage account.

Example Resource Log Record #

{
  "ActivityStatus": "",
  "ActivityStatusValue": "Success",
  "ActivitySubstatus": "",
  "ActivitySubstatusValue": "",
  "Authorization": {
    "scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Storage/storageAccounts/zcsa25394",
    "action": "Microsoft.Storage/storageAccounts/delete",
    "evidence": {
      "role": "Owner",
      "roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
      "roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
      "roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
      "principalId": "aaaaaaaa000000000000000000000001",
      "principalType": "User"
    }
  },
  "Authorization_d": {
    "scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Storage/storageAccounts/zcsa25394",
    "action": "Microsoft.Storage/storageAccounts/delete",
    "evidence": {
      "role": "Owner",
      "roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
      "roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
      "roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
      "principalId": "aaaaaaaa000000000000000000000001",
      "principalType": "User"
    }
  },
  "Caller": "adminuser@example.onmicrosoft.com",
  "CallerIpAddress": "203.0.113.10",
  "Category": "",
  "CategoryValue": "Administrative",
  "Claims": {
    "aud": "https://management.core.windows.net/",
    "iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
    "iat": "1782752670",
    "nbf": "1782752670",
    "exp": "1782756583",
    "http://schemas.microsoft.com/claims/authnclassreference": "1",
    "acrs": "p1",
    "aio": "REDACTED",
    "http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
    "appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
    "appidacr": "0",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
    "groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
    "idtyp": "user",
    "ipaddr": "203.0.113.10",
    "name": "Admin User",
    "http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
    "puid": "REDACTED",
    "rh": "REDACTED",
    "http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
    "sid": "0022840a-e4ab-884c-587f-d20d24637227",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
    "http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
    "uti": "REDACTED",
    "ver": "1.0",
    "wids": "REDACTED",
    "xms_act_fct": "3 5",
    "xms_ftd": "Qm3VI9ndhO4eGa9PlO2ooXp_lItcoAEfvdN1STz6NOIBdXNlYXN0LWRzbXM",
    "xms_idrel": "1 2",
    "xms_sub_fct": "2 3",
    "xms_tcdt": "1768616282"
  },
  "Claims_d": {
    "aud": "https://management.core.windows.net/",
    "iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
    "iat": "1782752670",
    "nbf": "1782752670",
    "exp": "1782756583",
    "aio": "REDACTED",
    "appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
    "appidacr": "0",
    "idtyp": "user",
    "http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
    "rh": "REDACTED",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
    "http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
    "uti": "REDACTED",
    "ver": "1.0",
    "wids": "REDACTED",
    "xms_act_fct": "3 5",
    "xms_ftd": "Qm3VI9ndhO4eGa9PlO2ooXp_lItcoAEfvdN1STz6NOIBdXNlYXN0LWRzbXM",
    "xms_idrel": "1 2",
    "xms_sub_fct": "2 3",
    "xms_tcdt": "1768616282",
    "groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
    "http://schemas.microsoft.com/claims/authnclassreference": "1",
    "acrs": "p1",
    "http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
    "ipaddr": "203.0.113.10",
    "name": "Admin User",
    "puid": "REDACTED",
    "http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
    "sid": "0022840a-e4ab-884c-587f-d20d24637227",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com"
  },
  "CorrelationId": "fc1a2604-7b0a-493d-8552-f679c469fff7",
  "EventDataId": "29fa9414-6fc7-e092-2035-d8ee6a28cfe8",
  "EventSubmissionTimestamp": "2026-06-29T18:11:31.2147942Z",
  "HTTPRequest": {
    "clientIpAddress": "203.0.113.10"
  },
  "Hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
  "Level": "Information",
  "OperationId": "",
  "OperationName": "",
  "OperationNameValue": "MICROSOFT.STORAGE/STORAGEACCOUNTS/DELETE",
  "Properties": {
    "eventCategory": "Administrative",
    "entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.Storage/storageAccounts/zcsa25394",
    "message": "Microsoft.Storage/storageAccounts/delete",
    "hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
    "caller": "adminuser@example.onmicrosoft.com",
    "eventDataId": "29fa9414-6fc7-e092-2035-d8ee6a28cfe8",
    "eventSubmissionTimestamp": "2026-06-29T18:11:31.2147942Z",
    "httpRequest": {
      "clientIpAddress": "203.0.113.10"
    },
    "resource": "zcsa25394",
    "resourceGroup": "RG-LOGCAPTURE-GEN",
    "resourceProviderValue": "MICROSOFT.STORAGE",
    "subscriptionId": "22222222-2222-2222-2222-222222222222",
    "activityStatusValue": "Success"
  },
  "Properties_d": {
    "eventCategory": "Administrative",
    "entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.Storage/storageAccounts/zcsa25394",
    "message": "Microsoft.Storage/storageAccounts/delete",
    "hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
    "caller": "adminuser@example.onmicrosoft.com",
    "eventDataId": "29fa9414-6fc7-e092-2035-d8ee6a28cfe8",
    "eventSubmissionTimestamp": "2026-06-29T18:11:31.2147942Z",
    "httpRequest": {
      "clientIpAddress": "203.0.113.10"
    },
    "resource": "zcsa25394",
    "resourceGroup": "RG-LOGCAPTURE-GEN",
    "resourceProviderValue": "MICROSOFT.STORAGE",
    "subscriptionId": "22222222-2222-2222-2222-222222222222",
    "activityStatusValue": "Success"
  },
  "Resource": "",
  "ResourceGroup": "RG-LOGCAPTURE-GEN",
  "ResourceId": "",
  "ResourceProvider": "",
  "ResourceProviderValue": "MICROSOFT.STORAGE",
  "SourceSystem": "Azure",
  "SubscriptionId": "22222222-2222-2222-2222-222222222222",
  "TenantId": "00000000-0000-0000-0000-000000000000",
  "TimeGenerated": "2026-06-29T18:11:31.2147942Z",
  "Type": "AzureActivity",
  "_ResourceId": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/microsoft.storage/storageaccounts/zcsa25394"
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`azure.activitylogs.identity.claims_initiated_by_user.name` (elastic rule field)	is_not_null		2 rules	elastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

Azure Storage Account Deletion by Unusual User source medium: Identifies when an Azure Storage Account is deleted. Adversaries may delete storage accounts to disrupt operations, destroy evidence, or cause denial of service. This activity could indicate an attacker attempting to cover their tracks after data exfiltration or as part of a destructive attack. Monitoring storage account deletions is critical for detecting potential impact on business operations and data availability.T1485, T1489
Azure Storage Account Deletions by User source high: Identifies when a single user or service principal deletes multiple Azure Storage Accounts within a short time period. This behavior may indicate an adversary attempting to cause widespread service disruption, destroy evidence, or execute a destructive attack such as ransomware. Mass deletion of storage accounts can have severe business impact and is rarely performed by legitimate administrators except during controlled decommissioning activities.T1485, T1489

Panther #

Azure Storage Account Deleted source high: Detects when an Azure storage account is deleted. Storage account deletion is a destructive operation that may indicate ransomware activity or malicious data destruction.T1485, T1490

Microsoft.Storage/storageAccounts/encryptionScopes/hoboConfigurations/write

Namespace: Microsoft.Storage

Microsoft.Storage/storageAccounts/encryptionScopes/write

Namespace: Microsoft.Storage

Microsoft.Storage/storageAccounts/failover/action

Namespace: Microsoft.Storage

Description

Customer is able to control the failover in case of availability issues

Microsoft.Storage/storageAccounts/fileServices/generateUserDelegationKey/action

Namespace: Microsoft.Storage

Description

Returns a user delegation key for the file service

Microsoft.Storage/storageAccounts/fileServices/providers/Microsoft.Insights/diagnosticSettings/write

Namespace: Microsoft.Storage

Description

Creates or updates the diagnostic setting for the resource.

Microsoft.Storage/storageAccounts/fileServices/shares/delete

Namespace: Microsoft.Storage

Description

Delete file share

Microsoft.Storage/storageAccounts/fileServices/shares/lease/action

Namespace: Microsoft.Storage

Microsoft.Storage/storageAccounts/fileServices/shares/restore/action

Namespace: Microsoft.Storage

Description

Restore file share

Microsoft.Storage/storageAccounts/fileServices/shares/revert/action

Namespace: Microsoft.Storage

Description

Revert File Share

Microsoft.Storage/storageAccounts/fileServices/shares/write

Namespace: Microsoft.Storage

Description

Create or update file share

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Panther #

Azure Storage File Share Created or Modified source informational: Detects when an Azure Storage file share is created or modified. File shares can be mounted as network drives using SMB or NFS protocols, providing persistent access to storage. Adversaries may create or modify file shares to establish data exfiltration channels or mount shares to local systems for easier data transfer. While file share operations are common in legitimate scenarios, monitoring these activities helps establish baselines and identify unusual patterns that may indicate data exfiltration.T1048, T1530

Microsoft.Storage/storageAccounts/fileServices/write

Namespace: Microsoft.Storage

Description

Put file service properties

Microsoft.Storage/storageAccounts/hnsonmigration/action

Namespace: Microsoft.Storage

Description

Customer is able to migrate to hns account type

Microsoft.Storage/storageAccounts/hoboConfigurations/write

Namespace: Microsoft.Storage

Microsoft.Storage/storageAccounts/inventoryPolicies/delete

Namespace: Microsoft.Storage

Microsoft.Storage/storageAccounts/inventoryPolicies/write

Namespace: Microsoft.Storage

Microsoft.Storage/storageAccounts/joinPerimeter/action

Namespace: Microsoft.Storage

Description

Access check for joining Network Security Perimeter

Microsoft.Storage/storageAccounts/listAccountSas/action

Namespace: Microsoft.Storage

Description

Returns the Account SAS token for the specified storage account.

Microsoft.Storage/storageAccounts/listkeys/action

Namespace: Microsoft.Storage

Description

Returns the access keys for the specified storage account.

Example Resource Log Record #

{
  "ActivityStatusValue": "Success",
  "ActivitySubstatusValue": "OK",
  "Authorization": {
    "scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Storage/storageAccounts/dwhc6a93dsa",
    "action": "Microsoft.Storage/storageAccounts/listKeys/action",
    "evidence": {
      "role": "Owner",
      "roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
      "roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
      "roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
      "principalId": "aaaaaaaa000000000000000000000001",
      "principalType": "User"
    }
  },
  "Authorization_d": {
    "scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Storage/storageAccounts/dwhc6a93dsa",
    "action": "Microsoft.Storage/storageAccounts/listKeys/action",
    "evidence": {
      "role": "Owner",
      "roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
      "roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
      "roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
      "principalId": "aaaaaaaa000000000000000000000001",
      "principalType": "User"
    }
  },
  "Caller": "adminuser@example.onmicrosoft.com",
  "CallerIpAddress": "203.0.113.10",
  "CategoryValue": "Administrative",
  "Claims": {
    "aud": "https://management.core.windows.net/",
    "iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
    "iat": "1783041418",
    "nbf": "1783041418",
    "exp": "1783045937",
    "http://schemas.microsoft.com/claims/authnclassreference": "1",
    "acrs": "p1",
    "aio": "AXQAi/8cAAAAFIBIEdHXWN3pylNjmPLeQhWfcQ14ANLMkCfF9E8NqZtiUHdHNiO4QKChB+m3872z7F73QjwZK8qIldMrqscbefkaL+FBLWCt9JK9djz/ONZSfAxBzNSQV2uzP3xMJVD4RnM7NXOM1v57WDtsGbmO1g==",
    "http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
    "appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
    "appidacr": "0",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
    "groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
    "idtyp": "user",
    "ipaddr": "203.0.113.10",
    "name": "Admin User",
    "http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
    "puid": "1111111111111111",
    "rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
    "http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
    "sid": "0022840a-e4ab-884c-587f-d20d24637227",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
    "http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
    "uti": "tUdFU6nO4UmtUjpbHDqEAA",
    "ver": "1.0",
    "wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
    "xms_act_fct": "3 5",
    "xms_ftd": "Jy-cEgg_SioO6K76SbtPp6tIHeVnjtpmAf1GT_VpKMsBdXNzb3V0aC1kc21z",
    "xms_idrel": "1 6",
    "xms_sub_fct": "3 4",
    "xms_tcdt": "1768616282"
  },
  "Claims_d": {
    "aud": "https://management.core.windows.net/",
    "iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
    "iat": "1783041418",
    "nbf": "1783041418",
    "exp": "1783045937",
    "http://schemas.microsoft.com/claims/authnclassreference": "1",
    "acrs": "p1",
    "aio": "AXQAi/8cAAAAFIBIEdHXWN3pylNjmPLeQhWfcQ14ANLMkCfF9E8NqZtiUHdHNiO4QKChB+m3872z7F73QjwZK8qIldMrqscbefkaL+FBLWCt9JK9djz/ONZSfAxBzNSQV2uzP3xMJVD4RnM7NXOM1v57WDtsGbmO1g==",
    "http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
    "appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
    "appidacr": "0",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
    "groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
    "idtyp": "user",
    "ipaddr": "203.0.113.10",
    "name": "Admin User",
    "http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
    "puid": "1111111111111111",
    "rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
    "http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
    "sid": "0022840a-e4ab-884c-587f-d20d24637227",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
    "http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
    "uti": "tUdFU6nO4UmtUjpbHDqEAA",
    "ver": "1.0",
    "wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
    "xms_act_fct": "3 5",
    "xms_ftd": "Jy-cEgg_SioO6K76SbtPp6tIHeVnjtpmAf1GT_VpKMsBdXNzb3V0aC1kc21z",
    "xms_idrel": "1 6",
    "xms_sub_fct": "3 4",
    "xms_tcdt": "1768616282"
  },
  "CorrelationId": "2815a35c-c303-4de7-8178-760ed598170e",
  "EventDataId": "6689e3c5-b2cf-9da5-7956-47aa7098b287",
  "EventSubmissionTimestamp": "2026-07-03T02:17:04.173868Z",
  "HTTPRequest": {
    "clientIpAddress": "203.0.113.10"
  },
  "Hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
  "Level": "Information",
  "OperationNameValue": "MICROSOFT.STORAGE/STORAGEACCOUNTS/LISTKEYS/ACTION",
  "Properties": {
    "statusCode": "OK",
    "serviceRequestId": "",
    "eventCategory": "Administrative",
    "entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Storage/storageAccounts/dwhc6a93dsa",
    "message": "Microsoft.Storage/storageAccounts/listKeys/action",
    "hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
    "caller": "adminuser@example.onmicrosoft.com",
    "eventDataId": "6689e3c5-b2cf-9da5-7956-47aa7098b287",
    "eventSubmissionTimestamp": "2026-07-03T02:17:04.173868Z",
    "httpRequest": {
      "clientIpAddress": "203.0.113.10"
    },
    "resource": "dwhc6a93dsa",
    "resourceGroup": "rg-logcapture-gen",
    "resourceProviderValue": "MICROSOFT.STORAGE",
    "subscriptionId": "22222222-2222-2222-2222-222222222222",
    "activityStatusValue": "Success",
    "activitySubstatusValue": "OK"
  },
  "Properties_d": {
    "statusCode": "OK",
    "serviceRequestId": "",
    "eventCategory": "Administrative",
    "entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Storage/storageAccounts/dwhc6a93dsa",
    "message": "Microsoft.Storage/storageAccounts/listKeys/action",
    "hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
    "caller": "adminuser@example.onmicrosoft.com",
    "eventDataId": "6689e3c5-b2cf-9da5-7956-47aa7098b287",
    "eventSubmissionTimestamp": "2026-07-03T02:17:04.1738680Z",
    "httpRequest": {
      "clientIpAddress": "203.0.113.10"
    },
    "resource": "dwhc6a93dsa",
    "resourceGroup": "rg-logcapture-gen",
    "resourceProviderValue": "MICROSOFT.STORAGE",
    "subscriptionId": "22222222-2222-2222-2222-222222222222",
    "activityStatusValue": "Success",
    "activitySubstatusValue": "OK"
  },
  "ResourceGroup": "rg-logcapture-gen",
  "ResourceProviderValue": "MICROSOFT.STORAGE",
  "SubscriptionId": "22222222-2222-2222-2222-222222222222"
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`ActivityStatusValue` (kusto rule field)	eq	`success`	2 rules	kusto
`azure.activitylogs.identity.authorization.evidence.principal_type` (elastic rule field)	eq	`user`	1 rule	elastic
`count_` (kusto rule field)	ge	`5`	1 rule	kusto

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Rare Subscription-level Operations In Azure source medium: Identifies IPs from which users grant access to other users on azure resources and alerts when a previously unseen source IP address is used.T1003

Elastic #

Azure Storage Account Keys Accessed by Privileged User source medium: Identifies unusual high-privileged access to Azure Storage Account keys by users with Owner, Contributor, or Storage Account Contributor roles. This technique was observed in STORM-0501 ransomware campaigns where compromised identities with high-privilege Azure RBAC roles retrieved access keys to perform unauthorized operations on Storage Accounts. Microsoft recommends using Shared Access Signature (SAS) models instead of direct key access for improved security. This rule detects when a user principal with high-privilege roles accesses storage keys for the first time in 7 days.T1078, T1078.004, T1555, T1555.006

Kusto #

New CloudShell User source low: Identifies when a user creates an Azure CloudShell for the first time. Monitor this activity to ensure only the expected users are using CloudShell.T1059↳ also matches Microsoft.Storage/storageAccounts/write

Panther #

Azure Storage Account Keys Listed source medium: Detects when Azure Storage Account access keys are listed or retrieved. This operation returns the full access keys which could grant complete control over the storage account and all its data. Adversaries may list storage account keys to gain persistent access to blob containers, file shares, queues, and tables without needing to maintain their current permissions.T1530, T1552

Microsoft.Storage/storageAccounts/listServiceSas/action

Namespace: Microsoft.Storage

Description

Returns the Service SAS token for the specified storage account.

Microsoft.Storage/storageAccounts/localUsers/delete

Namespace: Microsoft.Storage

Description

Delete local user

Microsoft.Storage/storageAccounts/localusers/listKeys/action

Namespace: Microsoft.Storage

Description

List local user keys

Microsoft.Storage/storageAccounts/localusers/regeneratePassword/action

Namespace: Microsoft.Storage

Microsoft.Storage/storageAccounts/localUsers/regenerateSharedKey/action

Namespace: Microsoft.Storage

Microsoft.Storage/storageAccounts/localusers/write

Namespace: Microsoft.Storage

Description

Create or update local user

Microsoft.Storage/storageAccounts/managementPolicies/delete

Namespace: Microsoft.Storage

Description

Delete storage account management policies

Microsoft.Storage/storageAccounts/managementPolicies/write

Namespace: Microsoft.Storage

Description

Put storage account management policies

Microsoft.Storage/storageAccounts/networkSecurityPerimeterAssociationProxies/delete

Namespace: Microsoft.Storage

Microsoft.Storage/storageAccounts/networkSecurityPerimeterAssociationProxies/write

Namespace: Microsoft.Storage

Microsoft.Storage/storageAccounts/networkSecurityPerimeterConfigurations/action

Namespace: Microsoft.Storage

Microsoft.Storage/storageAccounts/objectReplicationPolicies/delete

Namespace: Microsoft.Storage

Description

Delete object replication policy

Microsoft.Storage/storageAccounts/objectReplicationPolicies/restorePointMarkers/write

Namespace: Microsoft.Storage

Description

Create object replication restore point marker

Microsoft.Storage/storageAccounts/objectReplicationPolicies/write

Namespace: Microsoft.Storage

Description

Create or update object replication policy

Microsoft.Storage/storageAccounts/privateEndpointConnectionProxies/delete

Namespace: Microsoft.Storage

Description

Delete Private Endpoint Connection Proxies

Microsoft.Storage/storageAccounts/privateEndpointConnectionProxies/updatePrivateEndpointProperties/action

Namespace: Microsoft.Storage

Description

Update storage account private endpoint properties

Microsoft.Storage/storageAccounts/privateEndpointConnectionProxies/validate/action

Namespace: Microsoft.Storage

Description

Validate Private Endpoint Connection Proxies

Microsoft.Storage/storageAccounts/privateEndpointConnectionProxies/write

Namespace: Microsoft.Storage

Description

Put Private Endpoint Connection Proxies

Microsoft.Storage/storageAccounts/privateEndpointConnections/delete

Namespace: Microsoft.Storage

Description

Delete Private Endpoint Connection

Microsoft.Storage/storageAccounts/privateEndpointConnections/write

Namespace: Microsoft.Storage

Description

Put Private Endpoint Connection

Microsoft.Storage/storageAccounts/PrivateEndpointConnectionsApproval/action

Namespace: Microsoft.Storage

Description

Approve Private Endpoint Connections

Microsoft.Storage/storageAccounts/privateEndpoints/move/action

Namespace: Microsoft.Storage

Microsoft.Storage/storageAccounts/providers/Microsoft.Insights/diagnosticSettings/write

Namespace: Microsoft.Storage

Description

Creates or updates the diagnostic setting for the resource.

Microsoft.Storage/storageAccounts/queueServices/generateUserDelegationKey/action

Namespace: Microsoft.Storage

Description

Returns a user delegation key for the queue service

Microsoft.Storage/storageAccounts/queueServices/providers/Microsoft.Insights/diagnosticSettings/write

Namespace: Microsoft.Storage

Description

Creates or updates the diagnostic setting for the resource.

Microsoft.Storage/storageAccounts/queueServices/queues/delete

Namespace: Microsoft.Storage

Description

Returns the result of deleting a queue

Microsoft.Storage/storageAccounts/queueServices/queues/getAcl/action

Namespace: Microsoft.Storage

Description

Returns the result of processing a message

Microsoft.Storage/storageAccounts/queueServices/queues/setAcl/action

Namespace: Microsoft.Storage

Description

Returns the result of processing a message

Microsoft.Storage/storageAccounts/queueServices/queues/write

Namespace: Microsoft.Storage

Description

Returns the result of writing a queue

Microsoft.Storage/storageAccounts/queueServices/write

Namespace: Microsoft.Storage

Description

Returns the result of setting queue service properties

Microsoft.Storage/storageAccounts/regeneratekey/action

Namespace: Microsoft.Storage

Description

Regenerates the access keys for the specified storage account.

Example Resource Log Record #

{
  "ActivityStatusValue": "Success",
  "ActivitySubstatusValue": "OK",
  "Authorization": {
    "scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Storage/storageAccounts/dwhc6a93dsa",
    "action": "Microsoft.Storage/storageAccounts/regenerateKey/action",
    "evidence": {
      "role": "Owner",
      "roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
      "roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
      "roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
      "principalId": "aaaaaaaa000000000000000000000001",
      "principalType": "User"
    }
  },
  "Authorization_d": {
    "scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Storage/storageAccounts/dwhc6a93dsa",
    "action": "Microsoft.Storage/storageAccounts/regenerateKey/action",
    "evidence": {
      "role": "Owner",
      "roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
      "roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
      "roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
      "principalId": "aaaaaaaa000000000000000000000001",
      "principalType": "User"
    }
  },
  "Caller": "adminuser@example.onmicrosoft.com",
  "CallerIpAddress": "203.0.113.10",
  "CategoryValue": "Administrative",
  "Claims": {
    "aud": "https://management.core.windows.net/",
    "iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
    "iat": "1783041418",
    "nbf": "1783041418",
    "exp": "1783045937",
    "http://schemas.microsoft.com/claims/authnclassreference": "1",
    "acrs": "p1",
    "aio": "AXQAi/8cAAAAFIBIEdHXWN3pylNjmPLeQhWfcQ14ANLMkCfF9E8NqZtiUHdHNiO4QKChB+m3872z7F73QjwZK8qIldMrqscbefkaL+FBLWCt9JK9djz/ONZSfAxBzNSQV2uzP3xMJVD4RnM7NXOM1v57WDtsGbmO1g==",
    "http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
    "appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
    "appidacr": "0",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
    "groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
    "idtyp": "user",
    "ipaddr": "203.0.113.10",
    "name": "Admin User",
    "http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
    "puid": "1111111111111111",
    "rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
    "http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
    "sid": "0022840a-e4ab-884c-587f-d20d24637227",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
    "http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
    "uti": "tUdFU6nO4UmtUjpbHDqEAA",
    "ver": "1.0",
    "wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
    "xms_act_fct": "3 5",
    "xms_ftd": "Jy-cEgg_SioO6K76SbtPp6tIHeVnjtpmAf1GT_VpKMsBdXNzb3V0aC1kc21z",
    "xms_idrel": "1 6",
    "xms_sub_fct": "3 4",
    "xms_tcdt": "1768616282"
  },
  "Claims_d": {
    "aud": "https://management.core.windows.net/",
    "iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
    "iat": "1783041418",
    "nbf": "1783041418",
    "exp": "1783045937",
    "http://schemas.microsoft.com/claims/authnclassreference": "1",
    "acrs": "p1",
    "aio": "AXQAi/8cAAAAFIBIEdHXWN3pylNjmPLeQhWfcQ14ANLMkCfF9E8NqZtiUHdHNiO4QKChB+m3872z7F73QjwZK8qIldMrqscbefkaL+FBLWCt9JK9djz/ONZSfAxBzNSQV2uzP3xMJVD4RnM7NXOM1v57WDtsGbmO1g==",
    "http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
    "appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
    "appidacr": "0",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
    "groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
    "idtyp": "user",
    "ipaddr": "203.0.113.10",
    "name": "Admin User",
    "http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
    "puid": "1111111111111111",
    "rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
    "http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
    "sid": "0022840a-e4ab-884c-587f-d20d24637227",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
    "http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
    "uti": "tUdFU6nO4UmtUjpbHDqEAA",
    "ver": "1.0",
    "wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
    "xms_act_fct": "3 5",
    "xms_ftd": "Jy-cEgg_SioO6K76SbtPp6tIHeVnjtpmAf1GT_VpKMsBdXNzb3V0aC1kc21z",
    "xms_idrel": "1 6",
    "xms_sub_fct": "3 4",
    "xms_tcdt": "1768616282"
  },
  "CorrelationId": "a54f8a7e-498e-42ec-ae7b-d9b8003d523a",
  "EventDataId": "b40d0c9a-e6ca-7a5a-d07c-af344bed0ea4",
  "EventSubmissionTimestamp": "2026-07-03T02:17:05.5450383Z",
  "HTTPRequest": {
    "clientIpAddress": "203.0.113.10"
  },
  "Hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
  "Level": "Information",
  "OperationNameValue": "MICROSOFT.STORAGE/STORAGEACCOUNTS/REGENERATEKEY/ACTION",
  "Properties": {
    "statusCode": "OK",
    "serviceRequestId": "",
    "eventCategory": "Administrative",
    "entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Storage/storageAccounts/dwhc6a93dsa",
    "message": "Microsoft.Storage/storageAccounts/regenerateKey/action",
    "hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
    "caller": "adminuser@example.onmicrosoft.com",
    "eventDataId": "b40d0c9a-e6ca-7a5a-d07c-af344bed0ea4",
    "eventSubmissionTimestamp": "2026-07-03T02:17:05.5450383Z",
    "httpRequest": {
      "clientIpAddress": "203.0.113.10"
    },
    "resource": "dwhc6a93dsa",
    "resourceGroup": "rg-logcapture-gen",
    "resourceProviderValue": "MICROSOFT.STORAGE",
    "subscriptionId": "22222222-2222-2222-2222-222222222222",
    "activityStatusValue": "Success",
    "activitySubstatusValue": "OK"
  },
  "Properties_d": {
    "statusCode": "OK",
    "serviceRequestId": "",
    "eventCategory": "Administrative",
    "entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Storage/storageAccounts/dwhc6a93dsa",
    "message": "Microsoft.Storage/storageAccounts/regenerateKey/action",
    "hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
    "caller": "adminuser@example.onmicrosoft.com",
    "eventDataId": "b40d0c9a-e6ca-7a5a-d07c-af344bed0ea4",
    "eventSubmissionTimestamp": "2026-07-03T02:17:05.5450383Z",
    "httpRequest": {
      "clientIpAddress": "203.0.113.10"
    },
    "resource": "dwhc6a93dsa",
    "resourceGroup": "rg-logcapture-gen",
    "resourceProviderValue": "MICROSOFT.STORAGE",
    "subscriptionId": "22222222-2222-2222-2222-222222222222",
    "activityStatusValue": "Success",
    "activitySubstatusValue": "OK"
  },
  "ResourceGroup": "rg-logcapture-gen",
  "ResourceProviderValue": "MICROSOFT.STORAGE",
  "SubscriptionId": "22222222-2222-2222-2222-222222222222"
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

Azure Storage Account Key Regenerated source low: Identifies a rotation to storage account access keys in Azure. Regenerating access keys can affect any applications or Azure services that are dependent on the storage account key. Adversaries may regenerate a key as a means of acquiring credentials to access systems and resources.T1098, T1098.001, T1552, T1552.005

Panther #

Azure Storage Account Key Regenerated source informational: Detects when an Azure storage account access key is regenerated. Key regeneration is a normal operational activity but may indicate an attacker attempting to maintain persistence or rotate credentials after compromise.T1098

Microsoft.Storage/storageAccounts/restoreBlobRanges/action

Namespace: Microsoft.Storage

Description

Restore blob ranges to the state of the specified time

Microsoft.Storage/storageAccounts/restorePoints/delete

Namespace: Microsoft.Storage

Description

Delete object replication restore point

Microsoft.Storage/storageAccounts/revokeUserDelegationKeys/action

Namespace: Microsoft.Storage

Description

Revokes all the user delegation keys for the specified storage account.

Microsoft.Storage/storageAccounts/rotateKey/action

Namespace: Microsoft.Storage

Microsoft.Storage/storageAccounts/services/diagnosticSettings/write

Namespace: Microsoft.Storage

Description

Create/Update storage account diagnostic settings.

Microsoft.Storage/storageAccounts/storageTaskAssignments/delete

Namespace: Microsoft.Storage

Microsoft.Storage/storageAccounts/storageTaskAssignments/write

Namespace: Microsoft.Storage

Microsoft.Storage/storageAccounts/tableServices/generateUserDelegationKey/action

Namespace: Microsoft.Storage

Description

Returns a user delegation key for the table service

Microsoft.Storage/storageAccounts/tableServices/providers/Microsoft.Insights/diagnosticSettings/write

Namespace: Microsoft.Storage

Description

Creates or updates the diagnostic setting for the resource.

Microsoft.Storage/storageAccounts/tableServices/tables/delete

Namespace: Microsoft.Storage

Description

Delete tables

Microsoft.Storage/storageAccounts/tableServices/tables/getAcl/action

Namespace: Microsoft.Storage

Description

Merge or update table entities

Microsoft.Storage/storageAccounts/tableServices/tables/setAcl/action

Namespace: Microsoft.Storage

Description

Merge or update table entities

Microsoft.Storage/storageAccounts/tableServices/tables/write

Namespace: Microsoft.Storage

Description

Create tables

Microsoft.Storage/storageAccounts/tableServices/write

Namespace: Microsoft.Storage

Description

Set table service properties

Microsoft.Storage/storageAccounts/updateAccountContainerHoldingPeriod/action

Namespace: Microsoft.Storage

Microsoft.Storage/storageAccounts/updateAutoRotateUserKeys/action

Namespace: Microsoft.Storage

Microsoft.Storage/storageAccounts/updateInternalProperties/action

Namespace: Microsoft.Storage

Microsoft.Storage/storageAccounts/write

Namespace: Microsoft.Storage

Description

Creates a storage account with the specified parameters or update the properties or tags or adds custom domain for the specified storage account.

Example Resource Log Record #

{
  "ActivityStatus": "",
  "ActivityStatusValue": "Success",
  "ActivitySubstatus": "",
  "ActivitySubstatusValue": "",
  "Authorization": {
    "scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Storage/storageAccounts/zcsa25394",
    "action": "Microsoft.Storage/storageAccounts/write",
    "evidence": {
      "role": "Owner",
      "roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
      "roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
      "roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
      "principalId": "aaaaaaaa000000000000000000000001",
      "principalType": "User"
    }
  },
  "Authorization_d": {
    "scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Storage/storageAccounts/zcsa25394",
    "action": "Microsoft.Storage/storageAccounts/write",
    "evidence": {
      "role": "Owner",
      "roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
      "roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
      "roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
      "principalId": "aaaaaaaa000000000000000000000001",
      "principalType": "User"
    }
  },
  "Caller": "adminuser@example.onmicrosoft.com",
  "CallerIpAddress": "203.0.113.10",
  "Category": "",
  "CategoryValue": "Administrative",
  "Claims": {
    "aud": "https://management.core.windows.net/",
    "iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
    "iat": "1782752670",
    "nbf": "1782752670",
    "exp": "1782756583",
    "http://schemas.microsoft.com/claims/authnclassreference": "1",
    "acrs": "p1",
    "aio": "REDACTED",
    "http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
    "appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
    "appidacr": "0",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
    "groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
    "idtyp": "user",
    "ipaddr": "203.0.113.10",
    "name": "Admin User",
    "http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
    "puid": "REDACTED",
    "rh": "REDACTED",
    "http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
    "sid": "0022840a-e4ab-884c-587f-d20d24637227",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
    "http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
    "uti": "REDACTED",
    "ver": "1.0",
    "wids": "REDACTED",
    "xms_act_fct": "3 5",
    "xms_ftd": "Qm3VI9ndhO4eGa9PlO2ooXp_lItcoAEfvdN1STz6NOIBdXNlYXN0LWRzbXM",
    "xms_idrel": "1 2",
    "xms_sub_fct": "2 3",
    "xms_tcdt": "1768616282"
  },
  "Claims_d": {
    "aud": "https://management.core.windows.net/",
    "iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
    "iat": "1782752670",
    "nbf": "1782752670",
    "exp": "1782756583",
    "aio": "REDACTED",
    "appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
    "appidacr": "0",
    "idtyp": "user",
    "http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
    "rh": "REDACTED",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
    "http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
    "uti": "REDACTED",
    "ver": "1.0",
    "wids": "REDACTED",
    "xms_act_fct": "3 5",
    "xms_ftd": "Qm3VI9ndhO4eGa9PlO2ooXp_lItcoAEfvdN1STz6NOIBdXNlYXN0LWRzbXM",
    "xms_idrel": "1 2",
    "xms_sub_fct": "2 3",
    "xms_tcdt": "1768616282",
    "groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
    "http://schemas.microsoft.com/claims/authnclassreference": "1",
    "acrs": "p1",
    "http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
    "ipaddr": "203.0.113.10",
    "name": "Admin User",
    "puid": "REDACTED",
    "http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
    "sid": "0022840a-e4ab-884c-587f-d20d24637227",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com"
  },
  "CorrelationId": "584251ce-eb35-46eb-acec-6721a6073546",
  "EventDataId": "876eed4f-7d11-8970-4fb1-4a7700dd1893",
  "EventSubmissionTimestamp": "2026-06-29T17:50:17.1099996Z",
  "HTTPRequest": {
    "clientIpAddress": "203.0.113.10"
  },
  "Hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
  "Level": "Information",
  "OperationId": "",
  "OperationName": "",
  "OperationNameValue": "MICROSOFT.STORAGE/STORAGEACCOUNTS/WRITE",
  "Properties": {
    "eventCategory": "Administrative",
    "entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.Storage/storageAccounts/zcsa25394",
    "message": "Microsoft.Storage/storageAccounts/write",
    "hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
    "caller": "adminuser@example.onmicrosoft.com",
    "eventDataId": "876eed4f-7d11-8970-4fb1-4a7700dd1893",
    "eventSubmissionTimestamp": "2026-06-29T17:50:17.1099996Z",
    "httpRequest": {
      "clientIpAddress": "203.0.113.10"
    },
    "resource": "zcsa25394",
    "resourceGroup": "RG-LOGCAPTURE-GEN",
    "resourceProviderValue": "MICROSOFT.STORAGE",
    "subscriptionId": "22222222-2222-2222-2222-222222222222",
    "activityStatusValue": "Success"
  },
  "Properties_d": {
    "eventCategory": "Administrative",
    "entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.Storage/storageAccounts/zcsa25394",
    "message": "Microsoft.Storage/storageAccounts/write",
    "hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
    "caller": "adminuser@example.onmicrosoft.com",
    "eventDataId": "876eed4f-7d11-8970-4fb1-4a7700dd1893",
    "eventSubmissionTimestamp": "2026-06-29T17:50:17.1099996Z",
    "httpRequest": {
      "clientIpAddress": "203.0.113.10"
    },
    "resource": "zcsa25394",
    "resourceGroup": "RG-LOGCAPTURE-GEN",
    "resourceProviderValue": "MICROSOFT.STORAGE",
    "subscriptionId": "22222222-2222-2222-2222-222222222222",
    "activityStatusValue": "Success"
  },
  "Resource": "",
  "ResourceGroup": "RG-LOGCAPTURE-GEN",
  "ResourceId": "",
  "ResourceProvider": "",
  "ResourceProviderValue": "MICROSOFT.STORAGE",
  "SourceSystem": "Azure",
  "SubscriptionId": "22222222-2222-2222-2222-222222222222",
  "TenantId": "00000000-0000-0000-0000-000000000000",
  "TimeGenerated": "2026-06-29T17:50:17.1099996Z",
  "Type": "AzureActivity",
  "_ResourceId": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/microsoft.storage/storageaccounts/zcsa25394"
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`resultType` (panther rule field)	in	`Succeeded`	4 rules	panther
`resultType` (panther rule field)	in	`Success`	4 rules	panther
`ActivityStatusValue` (kusto rule field)	eq	`success`	1 rule	kusto

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

Azure Storage Account Blob Public Access Enabled source medium: Identifies when Azure Storage Account Blob public access is enabled, allowing external access to blob containers. This technique was observed in cloud ransom-based campaigns where threat actors modified storage accounts to expose non-remotely accessible accounts to the internet for data exfiltration. Adversaries abuse the Microsoft.Storage/storageAccounts/write operation to modify public access settings.T1530

Kusto #

New CloudShell User source low: Identifies when a user creates an Azure CloudShell for the first time. Monitor this activity to ensure only the expected users are using CloudShell.T1059↳ also matches Microsoft.Storage/storageAccounts/listkeys/action

Panther #

Azure Storage Account Shared Key Access Enabled source medium: Detects when an existing Azure storage account's shared key access is enabled (allowSharedKeyAccess: true). Shared key access uses storage account keys for authentication, which is less secure than Azure AD-based authentication.T1098
Azure Storage Account Public Network Access Enabled source high: Detects when an existing Azure storage account's network settings are modified to enable public network access. This could indicate a potential data exfiltration risk or misconfiguration.T1567
Azure Storage Account HTTPS-Only Traffic Disabled source high: Detects when Azure storage account HTTPS-only traffic requirement is disabled. Disabling HTTPS-only allows unencrypted HTTP connections, which is a security downgrade that may expose data in transit.T1071

Show 1 more (4 total) on the rules page

Microsoft.Storage/storageTasks/delete

Namespace: Microsoft.Storage

Description

Deletes an existing storage task

Microsoft.Storage/storageTasks/promote/action

Namespace: Microsoft.Storage

Description

Promote specific version of storage task to current version

Microsoft.Storage/storageTasks/write

Namespace: Microsoft.Storage

Description

Creates or updates storage task

Microsoft.Storage/unregister/action

Namespace: Microsoft.Storage

Microsoft.Storage/contextCaches/contextCacheContainers/delete

Namespace: Microsoft.Storage

Description

Delete a container from a Context Cache resource.

Microsoft.Storage/contextCaches/contextCacheContainers/write

Namespace: Microsoft.Storage

Description

Create or update a container in a Context Cache resource.

Microsoft.Storage/contextCaches/delete

Namespace: Microsoft.Storage

Description

Delete a Context Cache resource.

Microsoft.Storage/contextCaches/write

Namespace: Microsoft.Storage

Description

Create or update a Context Cache resource.

Microsoft.Storage/locations/ContextCacheRPOperationStatuses/write

Namespace: Microsoft.Storage

Description

Writes the status of an asynchronous Context Cache operation.

Microsoft.Storage/storageAccounts/abortHnsOnMigration/action

Namespace: Microsoft.Storage

Description

Customer is able to abort an ongoing Hns migration on the storage account

Microsoft.Storage/storageAccounts/encryptionScopes/sharedIdentities/write

Namespace: Microsoft.Storage

Description

Put shared identity for a storage account's encryption scope

Microsoft.Storage/storageAccounts/sharedIdentities/write

Namespace: Microsoft.Storage

Azure Storage Azure-Microsoft.Storage

any: Azure Storage (catch-all)

Description

Microsoft.Storage/locations/ActionsRPOperationStatuses/write

Description

Microsoft.Storage/locations/DataManagementRPOperationStatuses/write

Description

Microsoft.Storage/locations/deleteVirtualNetworkOrSubnets/action

Description

Microsoft.Storage/locations/notifyNetworkSecurityPerimeterUpdatesAvailable/action

Microsoft.Storage/locations/previewActions/action

Microsoft.Storage/register/action

Description

Microsoft.Storage/storageAccounts/accountLocks/delete

Microsoft.Storage/storageAccounts/accountLocks/deleteLock/action

Microsoft.Storage/storageAccounts/accountLocks/write

Microsoft.Storage/storageAccounts/accountMigrations/write

Description

Microsoft.Storage/storageAccounts/advancedPlatformMetrics/delete

Microsoft.Storage/storageAccounts/advancedPlatformMetrics/write

Microsoft.Storage/storageAccounts/blobServices/containers/clearLegalHold/action

Description

Microsoft.Storage/storageAccounts/blobServices/containers/delete

Description

Microsoft.Storage/storageAccounts/blobServices/containers/getAcl/action

Microsoft.Storage/storageAccounts/blobServices/containers/immutabilityPolicies/delete

Description

Detection Rules #

Panther #

Microsoft.Storage/storageAccounts/blobServices/containers/immutabilityPolicies/extend/action

Description

Microsoft.Storage/storageAccounts/blobServices/containers/immutabilityPolicies/lock/action

Description

Microsoft.Storage/storageAccounts/blobServices/containers/immutabilityPolicies/write

Description

Microsoft.Storage/storageAccounts/blobServices/containers/lease/action

Description

Microsoft.Storage/storageAccounts/blobServices/containers/migrate/action

Microsoft.Storage/storageAccounts/blobServices/containers/setAcl/action

Microsoft.Storage/storageAccounts/blobServices/containers/setLegalHold/action

Description

Microsoft.Storage/storageAccounts/blobServices/containers/write

Description

Common Indicators #

Related events #

Detection Rules #

Elastic #

Panther #

Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action

Description

Microsoft.Storage/storageAccounts/blobServices/getInfo/action

Microsoft.Storage/storageAccounts/blobServices/providers/Microsoft.Insights/diagnosticSettings/write

Description

Microsoft.Storage/storageAccounts/blobServices/write

Description

Common Indicators #

Related events #

Detection Rules #

Panther #

Microsoft.Storage/storageAccounts/connectors/delete

Description

Microsoft.Storage/storageAccounts/connectors/testExistingConnection/action

Description

Microsoft.Storage/storageAccounts/connectors/write

Description

Microsoft.Storage/storageAccounts/consumerDataShare/action

Microsoft.Storage/storageAccounts/consumerDataSharePolicies/write

Microsoft.Storage/storageAccounts/dataSharePolicies/delete

Microsoft.Storage/storageAccounts/dataSharePolicies/write

Microsoft.Storage/storageAccounts/dataShares/delete

Description

Microsoft.Storage/storageAccounts/dataShares/write

Description

Microsoft.Storage/storageAccounts/delete

Description

Example Resource Log Record #

Common Indicators #

Detection Rules #

Elastic #

Panther #