Azure Storage Blob Soft Delete Disabled

AnalysisType: rule
Filename: azure_storage_blob_soft_delete_disabled.py
RuleID: "Azure.MonitorActivity.StorageAccount.BlobSoftDeleteDisabled"
DisplayName: "Azure Storage Blob Soft Delete Disabled"
Enabled: true
LogTypes:
  - Azure.MonitorActivity
Severity: High
Description: >
  Detects when Azure storage account blob soft delete is disabled.
  Disabling soft delete removes protection against accidental deletion and may indicate preparation for data destruction.
Reports:
  MITRE ATT&CK:
    - TA0040:T1485 # Impact: Data Destruction
    - TA0040:T1490 # Impact: Inhibit System Recovery
Tags:
  - Impact
  - Data Destruction
  - Inhibit System Recovery
  - Ransomware
Runbook: |
  1. Query Azure Monitor Activity logs for all storage account blob service operations by the callerIpAddress in the 6 hours before and after this alert to identify patterns
  2. Check if the source IP is associated with known cloud providers, VPN services, or corporate network ranges using threat intelligence
  3. Search for other Azure storage account configuration changes or blob deletion events from the same user or IP in the past 7 days to assess if this is part of a data destruction campaign
Reference: https://azure.github.io/azure-storage-java/com/microsoft/azure/storage/DeleteRetentionPolicy.html
SummaryAttributes:
  - resourceId
  - callerIpAddress
  - correlationId
Tests:
  - Name: Soft Delete Disabled
    ExpectedResult: true
    Log:
      {
        "time": "2024-12-17T10:30:00.0000000Z",
        "resourceId": "/subscriptions/12345678-1234-1234-1234-123456789abc/resourceGroups/myresourcegroup/providers/Microsoft.Storage/storageAccounts/mystorageaccount/blobServices/default",
        "operationName": "Microsoft.Storage/storageAccounts/blobServices/write",
        "operationVersion": "2021-04-01",
        "category": "Administrative",
        "resultType": "Success",
        "callerIpAddress": "1.1.1.1",
        "location": "eastus",
        "correlationId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
        "properties": {
          "requestbody": "{\"properties\":{\"deleteRetentionPolicy\":{\"enabled\":false}}}"
        },
        "tenantId": "87654321-4321-4321-4321-111111111111"
      }
  - Name: Soft Delete Enabled
    ExpectedResult: false
    Log:
      {
        "time": "2024-12-17T12:00:00.0000000Z",
        "resourceId": "/subscriptions/12345678-1234-1234-1234-123456789abc/resourceGroups/myresourcegroup/providers/Microsoft.Storage/storageAccounts/securestorageaccount/blobServices/default",
        "operationName": "Microsoft.Storage/storageAccounts/blobServices/write",
        "operationVersion": "2021-04-01",
        "category": "Administrative",
        "resultType": "Success",
        "callerIpAddress": "203.0.113.50",
        "location": "eastus",
        "correlationId": "c3d4e5f6-a7b8-9012-cdef-123456789012",
        "properties": {
          "requestbody": "{\"properties\":{\"deleteRetentionPolicy\":{\"enabled\":true,\"days\":7}}}"
        },
        "tenantId": "87654321-4321-4321-4321-210987654321"
      }

# ------ paired body: azure_storage_blob_soft_delete_disabled.py ------

from panther_azureactivity_helpers import (
    azure_activity_alert_context,
    azure_activity_success,
    azure_parse_json_string,
    extract_resource_name_from_id,
)

BLOB_SERVICES_WRITE = "MICROSOFT.STORAGE/STORAGEACCOUNTS/BLOBSERVICES/WRITE"


def rule(event):
    requestbody = azure_parse_json_string(event.deep_get("properties", "requestbody", default=None))
    return all(
        [
            event.get("operationName", "").upper() == BLOB_SERVICES_WRITE,
            requestbody.get("properties", {}).get("deleteRetentionPolicy", {}).get("enabled")
            is False,
            azure_activity_success(event),
        ]
    )


def title(event):
    resource_id = event.get("resourceId", "")
    storage_account = extract_resource_name_from_id(
        resource_id, "storageAccounts", default="<UNKNOWN_ACCOUNT>"
    )
    return f"Azure Storage blob soft delete disabled on [{storage_account}]"


def alert_context(event):
    context = azure_activity_alert_context(event)
    return context