Detection rules › By event

Azure-Microsoft.Storage

Event	Rules
Microsoft.Storage/storageAccounts/blobServices/containers/immutabilityPolicies/delete	1
Microsoft.Storage/storageAccounts/blobServices/containers/write	3
Microsoft.Storage/storageAccounts/blobServices/write	4
Microsoft.Storage/storageAccounts/delete	3
Microsoft.Storage/storageAccounts/fileServices/shares/write	1
Microsoft.Storage/storageAccounts/listkeys/action	5
Microsoft.Storage/storageAccounts/regeneratekey/action	2
Microsoft.Storage/storageAccounts/write	6

Microsoft.Storage/storageAccounts/blobServices/containers/immutabilityPolicies/delete

1 detection rules reference this event. View event page.

Panther (1)

Azure Storage Immutability Policy Deleted severity high T1485, T1490, T1685

Microsoft.Storage/storageAccounts/blobServices/containers/write

3 detection rules reference this event. View event page.

Elastic (1)

Azure Blob Storage Container Access Level Modified severity low T1222, T1537, T1619

Panther (2)

Azure Storage Blob Anonymous Access Enabled severity high T1530
Azure Storage Blob Container Permissions Modified severity medium T1222, T1567.002

Microsoft.Storage/storageAccounts/blobServices/write

4 detection rules reference this event. View event page.

Panther (4)

Azure Storage Account Blob Versioning Disabled severity high T1485
Azure Storage Blob Anonymous Access Enabled severity high T1530
Azure Storage Blob Soft Delete Disabled severity high T1485, T1490
Azure Storage Container Soft Delete Disabled severity high T1485, T1490

Microsoft.Storage/storageAccounts/delete

3 detection rules reference this event. View event page.

Elastic (2)

Azure Storage Account Deletion by Unusual User severity medium T1485, T1489
Azure Storage Account Deletions by User severity high T1485, T1489

Panther (1)

Azure Storage Account Deleted severity high T1485, T1490

Microsoft.Storage/storageAccounts/fileServices/shares/write

1 detection rules reference this event. View event page.

Panther (1)

Azure Storage File Share Created or Modified severity informational T1048, T1530

Microsoft.Storage/storageAccounts/listkeys/action

5 detection rules reference this event. View event page.

Sigma (1)

Rare Subscription-level Operations In Azure severity medium T1003

Elastic (1)

Azure Storage Account Keys Accessed by Privileged User severity medium T1078, T1078.004, T1555, T1555.006

Kusto (2)

New CloudShell User severity low T1059
Rare subscription-level operations in Azure severity low T1003, T1098

Panther (1)

Azure Storage Account Keys Listed severity medium T1530, T1552

Microsoft.Storage/storageAccounts/regeneratekey/action

2 detection rules reference this event. View event page.

Elastic (1)

Azure Storage Account Key Regenerated severity low T1098, T1098.001, T1552, T1552.005

Panther (1)

Azure Storage Account Key Regenerated severity informational T1098

Microsoft.Storage/storageAccounts/write

6 detection rules reference this event. View event page.

Elastic (1)

Azure Storage Account Blob Public Access Enabled severity medium T1530

Kusto (1)

New CloudShell User severity low T1059

Panther (4)

Azure Storage Account HTTPS-Only Traffic Disabled severity high T1071
Azure Storage Account Public Network Access Enabled severity high T1567
Azure Storage Account Shared Key Access Enabled severity medium T1098
Azure Storage Blob Anonymous Access Enabled severity high T1530