Azure VM Disk SAS URI Generated

AnalysisType: rule
Filename: azure_vm_disk_sas_uri_generated.py
RuleID: "Azure.MonitorActivity.Compute.DiskSASURIGenerated"
DisplayName: "Azure VM Disk SAS URI Generated"
Enabled: true
LogTypes:
  - Azure.MonitorActivity
Severity: High
Description: >
  Detects when a Shared Access Signature (SAS) URI is generated for an Azure VM disk.
  SAS URIs provide time-limited, unauthenticated access to download disk contents directly from Azure Storage.
  Adversaries can generate SAS URIs to exfiltrate entire virtual machine disks, including operating systems,
  applications, and all data. This allows offline analysis to extract credentials, secrets, and sensitive data
  without detection. This is a critical indicator of data exfiltration and should be investigated immediately.
Reports:
  MITRE ATT&CK:
    - TA0010:T1567.002 # Exfiltration: Exfiltration Over Web Service - Exfiltration to Cloud Storage
    - TA0009:T1530 # Collection: Data from Cloud Storage
Tags:
  - AZT701.1
  - Exfiltration
  - Collection
  - Exfiltration Over Web Service
  - Exfiltration to Cloud Storage
  - Data from Cloud Storage
Runbook: |
  1. Find all disk and storage operations by the callerIpAddress in the 24 hours before and after this alert to identify if multiple disks are being exfiltrated
  2. Query for the VM associated with this disk to determine what applications and data are stored on the disk
  3. Check if the callerIpAddress has performed similar disk export operations in the past 90 days to determine if this is expected backup behavior
Reference: https://microsoft.github.io/Azure-Threat-Research-Matrix/Impact/AZT701/AZT701-1
SummaryAttributes:
  - resourceId
  - callerIpAddress
  - correlationId
Tests:
  - Name: SAS URI Generated for Disk
    ExpectedResult: true
    Log:
      {
        "time": "2025-12-23T10:30:00.0000000Z",
        "resourceId": "/subscriptions/12345678-1234-1234-1234-123456789abc/resourceGroups/vm-rg/providers/Microsoft.Compute/disks/vm-prod-osdisk",
        "operationName": "Microsoft.Compute/disks/beginGetAccess/action",
        "operationVersion": "2021-04-01",
        "category": "Administrative",
        "resultType": "Success",
        "resultSignature": "200",
        "callerIpAddress": "1.1.1.1",
        "correlationId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
        "level": "Informational",
        "location": "eastus",
        "tenantId": "87654321-4321-4321-4321-111111111111"
      }
  - Name: Disk Export with Succeeded Status
    ExpectedResult: true
    Log:
      {
        "time": "2025-12-23T11:00:00.0000000Z",
        "resourceId": "/subscriptions/11111111-1111-1111-1111-111111111111/resourceGroups/prod-rg/providers/Microsoft.Compute/disks/database-server-disk",
        "operationName": "Microsoft.Compute/disks/beginGetAccess/action",
        "category": "Administrative",
        "resultType": "Succeeded",
        "callerIpAddress": "2.2.2.2",
        "correlationId": "b2c3d4e5-f6a7-8901-bcde-f12345678901",
        "level": "Information",
        "location": "westeurope",
        "tenantId": "22222222-2222-2222-2222-222222222222"
      }
  - Name: Case Insensitive Match
    ExpectedResult: true
    Log:
      {
        "time": "2025-12-23T12:00:00.0000000Z",
        "resourceId": "/subscriptions/33333333-3333-3333-3333-333333333333/resourceGroups/security-rg/providers/Microsoft.Compute/disks/web-server-data-disk",
        "operationName": "microsoft.compute/disks/begingetaccess/action",
        "category": "Administrative",
        "resultType": "Success",
        "callerIpAddress": "3.3.3.3",
        "correlationId": "c3d4e5f6-a7b8-9012-cdef-333333333333",
        "level": "Informational",
        "location": "centralus",
        "tenantId": "33333333-3333-3333-3333-333333333333"
      }
  - Name: Data Disk SAS Generation
    ExpectedResult: true
    Log:
      {
        "time": "2025-12-23T13:00:00.0000000Z",
        "resourceId": "/subscriptions/44444444-4444-4444-4444-444444444444/resourceGroups/app-rg/providers/Microsoft.Compute/disks/app-server-datadisk-001",
        "operationName": "Microsoft.Compute/disks/beginGetAccess/action",
        "category": "Administrative",
        "resultType": "Success",
        "callerIpAddress": "4.4.4.4",
        "correlationId": "d4e5f6a7-b8c9-0123-def0-444444444444",
        "level": "Informational",
        "location": "westus",
        "tenantId": "44444444-4444-4444-4444-444444444444"
      }
  - Name: Different Operation
    ExpectedResult: false
    Log:
      {
        "time": "2025-12-23T16:00:00.0000000Z",
        "resourceId": "/subscriptions/77777777-7777-7777-7777-777777777777/resourceGroups/vm-rg/providers/Microsoft.Compute/disks/vm-disk",
        "operationName": "Microsoft.Compute/disks/read",
        "category": "Administrative",
        "resultType": "Success",
        "callerIpAddress": "7.7.7.7",
        "correlationId": "a7b8c9d0-e1f2-3456-0123-777777777777",
        "tenantId": "77777777-7777-7777-7777-777777777777"
      }

# ------ paired body: azure_vm_disk_sas_uri_generated.py ------

from panther_azureactivity_helpers import (
    azure_activity_alert_context,
    azure_activity_success,
    extract_resource_name_from_id,
)

DISK_SAS_OPERATIONS = [
    "MICROSOFT.COMPUTE/DISKS/BEGINGETACCESS/ACTION",
]


def rule(event):
    return event.get("operationName", "").upper() in DISK_SAS_OPERATIONS and azure_activity_success(
        event
    )


def title(event):
    resource_id = event.get("resourceId", "<UNKNOWN_RESOURCE>")

    disk_name = extract_resource_name_from_id(resource_id, "disks", default="<UNKNOWN_DISK>")

    return f"Azure VM Disk SAS URI Generated: [{disk_name}]"


def alert_context(event):
    context = azure_activity_alert_context(event)

    resource_id = event.get("resourceId", "")

    disk_name = extract_resource_name_from_id(resource_id, "disks", default="")
    if disk_name:
        context["disk_name"] = disk_name

    resource_group = extract_resource_name_from_id(resource_id, "resourceGroups", default="")
    if resource_group:
        context["resource_group"] = resource_group

    return context