Azure Storage File Share Created or Modified

AnalysisType: rule
Filename: azure_storage_fileshare_modified.py
RuleID: "Azure.MonitorActivity.Storage.FileShareModified"
DisplayName: "Azure Storage File Share Created or Modified"
Enabled: true
LogTypes:
  - Azure.MonitorActivity
Severity: Info
Description: >
  Detects when an Azure Storage file share is created or modified. File shares can be mounted as
  network drives using SMB or NFS protocols, providing persistent access to storage. Adversaries may
  create or modify file shares to establish data exfiltration channels or mount shares to local systems
  for easier data transfer. While file share operations are common in legitimate scenarios, monitoring
  these activities helps establish baselines and identify unusual patterns that may indicate data exfiltration.
Reports:
  MITRE ATT&CK:
    - TA0010:T1048 # Exfiltration: Exfiltration Over Alternative Protocol
    - TA0009:T1530 # Collection: Data from Cloud Storage
Tags:
  - Exfiltration
  - Exfiltration Over Alternative Protocol
  - Collection
  - Data from Cloud Storage
  - AZT702
  - AZT702.1
  - File Share Mounting
  - Storage Account File Share NFS/SMB Mount
Runbook: |
  1. Find all storage account operations by the callerIpAddress in the 6 hours before and after this alert to identify if this is part of a data staging or exfiltration pattern
  2. Query for the storage account configuration to determine if the file share has public access or is restricted to specific networks
  3. Check if the callerIpAddress has created or modified file shares in the past 30 days to determine if this is normal administrative behavior
Reference: https://microsoft.github.io/Azure-Threat-Research-Matrix/Impact/AZT702/AZT702-1
SummaryAttributes:
  - resourceId
  - callerIpAddress
  - correlationId
Tests:
  - Name: File Share Created
    ExpectedResult: true
    Log:
      {
        "time": "2025-12-23T10:30:00.0000000Z",
        "resourceId": "/subscriptions/12345678-1234-1234-1234-123456789abc/resourceGroups/storage-rg/providers/Microsoft.Storage/storageAccounts/mystorageaccount/fileServices/default/shares/data-share",
        "operationName": "Microsoft.Storage/storageAccounts/fileServices/shares/write",
        "operationVersion": "2021-09-01",
        "category": "Administrative",
        "resultType": "Success",
        "resultSignature": "201",
        "callerIpAddress": "1.1.1.1",
        "correlationId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
        "level": "Informational",
        "location": "eastus",
        "tenantId": "87654321-4321-4321-4321-111111111111"
      }
  - Name: File Share Modified
    ExpectedResult: true
    Log:
      {
        "time": "2025-12-23T11:00:00.0000000Z",
        "resourceId": "/subscriptions/11111111-1111-1111-1111-111111111111/resourceGroups/prod-rg/providers/Microsoft.Storage/storageAccounts/prodstorage/fileServices/default/shares/backup-share",
        "operationName": "Microsoft.Storage/storageAccounts/fileServices/shares/write",
        "category": "Administrative",
        "resultType": "Succeeded",
        "callerIpAddress": "2.2.2.2",
        "correlationId": "b2c3d4e5-f6a7-8901-bcde-f12345678901",
        "level": "Information",
        "location": "westeurope",
        "tenantId": "22222222-2222-2222-2222-222222222222"
      }
  - Name: Case Insensitive Match
    ExpectedResult: true
    Log:
      {
        "time": "2025-12-23T12:00:00.0000000Z",
        "resourceId": "/subscriptions/33333333-3333-3333-3333-333333333333/resourceGroups/app-rg/providers/Microsoft.Storage/storageAccounts/appstorage/fileServices/default/shares/app-data",
        "operationName": "microsoft.storage/storageaccounts/fileservices/shares/write",
        "category": "Administrative",
        "resultType": "Success",
        "callerIpAddress": "3.3.3.3",
        "correlationId": "c3d4e5f6-a7b8-9012-cdef-333333333333",
        "level": "Informational",
        "location": "centralus",
        "tenantId": "33333333-3333-3333-3333-333333333333"
      }
  - Name: Different Operation
    ExpectedResult: false
    Log:
      {
        "time": "2025-12-23T16:00:00.0000000Z",
        "resourceId": "/subscriptions/77777777-7777-7777-7777-777777777777/resourceGroups/storage-rg/providers/Microsoft.Storage/storageAccounts/storage/fileServices/default/shares/share",
        "operationName": "Microsoft.Storage/storageAccounts/fileServices/shares/read",
        "category": "Administrative",
        "resultType": "Success",
        "callerIpAddress": "7.7.7.7",
        "correlationId": "a7b8c9d0-e1f2-3456-0123-777777777777",
        "tenantId": "77777777-7777-7777-7777-777777777777"
      }

# ------ paired body: azure_storage_fileshare_modified.py ------

from panther_azureactivity_helpers import (
    azure_activity_alert_context,
    azure_activity_success,
    extract_resource_name_from_id,
)

FILESHARE_OPERATIONS = [
    "MICROSOFT.STORAGE/STORAGEACCOUNTS/FILESERVICES/SHARES/WRITE",
]


def rule(event):
    return event.get(
        "operationName", ""
    ).upper() in FILESHARE_OPERATIONS and azure_activity_success(event)


def title(event):
    resource_id = event.get("resourceId", "<UNKNOWN_RESOURCE>")
    share_name = extract_resource_name_from_id(resource_id, "shares", default="<UNKNOWN_SHARE>")
    return f"Azure Storage File Share Created or Modified: [{share_name}]"


def alert_context(event):
    context = azure_activity_alert_context(event)

    resource_id = event.get("resourceId", "")

    share_name = extract_resource_name_from_id(resource_id, "shares", default="")
    if share_name:
        context["share_name"] = share_name
    return context