Azure Storage Account HTTPS-Only Traffic Disabled

AnalysisType: rule
Filename: azure_storage_https_only_disabled.py
RuleID: "Azure.MonitorActivity.StorageAccount.HttpsOnlyDisabled"
DisplayName: "Azure Storage Account HTTPS-Only Traffic Disabled"
Enabled: true
LogTypes:
  - Azure.MonitorActivity
Severity: High
Description: >
  Detects when Azure storage account HTTPS-only traffic requirement is disabled.
  Disabling HTTPS-only allows unencrypted HTTP connections, which is a security downgrade that may expose data in transit.
Reports:
  MITRE ATT&CK:
    - TA0009:T1071 # Command and Control: Application Layer Protocol
Tags:
  - Command and Control
  - Application Layer Protocol
Runbook: |
  1. Query Azure Monitor Activity logs for all storage account operations by the callerIpAddress in the 6 hours before and after this alert to identify patterns
  2. Check if the source IP is associated with known cloud providers, VPN services, or corporate network ranges using threat intelligence
  3. Search for other Azure storage account security downgrades or suspicious configuration changes from the same user or IP in the past 7 days
Reference: https://learn.microsoft.com/en-us/azure/storage/common/storage-require-secure-transfer
SummaryAttributes:
  - resourceId
  - callerIpAddress
  - correlationId
Tests:
  - Name: HTTPS Only Disabled
    ExpectedResult: true
    Log:
      {
        "time": "2024-12-17T10:30:00.0000000Z",
        "resourceId": "/subscriptions/12345678-1234-1234-1234-123456789abc/resourceGroups/myresourcegroup/providers/Microsoft.Storage/storageAccounts/mystorageaccount",
        "operationName": "Microsoft.Storage/storageAccounts/write",
        "operationVersion": "2021-04-01",
        "category": "Administrative",
        "resultType": "Success",
        "callerIpAddress": "1.1.1.1",
        "correlationId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
        "properties": {
          "requestbody": "{\"properties\":{\"supportsHttpsTrafficOnly\":false}}"
        },
        "tenantId": "87654321-4321-4321-4321-111111111111"
      }
  - Name: HTTPS Only Enabled
    ExpectedResult: false
    Log:
      {
        "time": "2024-12-17T12:00:00.0000000Z",
        "resourceId": "/subscriptions/12345678-1234-1234-1234-123456789abc/resourceGroups/myresourcegroup/providers/Microsoft.Storage/storageAccounts/securestorageaccount",
        "operationName": "Microsoft.Storage/storageAccounts/write",
        "operationVersion": "2021-04-01",
        "category": "Administrative",
        "resultType": "Success",
        "callerIpAddress": "2.2.2.2",
        "correlationId": "c3d4e5f6-a7b8-9012-cdef-222222222222",
        "properties": {
          "requestbody": "{\"properties\":{\"supportsHttpsTrafficOnly\":true}}"
        },
        "tenantId": "87654321-4321-4321-4321-111111111111"
      }

# ------ paired body: azure_storage_https_only_disabled.py ------

from panther_azureactivity_helpers import (
    azure_activity_alert_context,
    azure_activity_success,
    azure_parse_json_string,
    extract_resource_name_from_id,
)

STORAGE_ACCOUNT_WRITE = "MICROSOFT.STORAGE/STORAGEACCOUNTS/WRITE"


def rule(event):
    requestbody = azure_parse_json_string(event.deep_get("properties", "requestbody", default=None))
    return all(
        [
            event.get("operationName", "").upper() == STORAGE_ACCOUNT_WRITE,
            requestbody.get("properties", {}).get("supportsHttpsTrafficOnly") is False,
            requestbody.get("location") is None,
            azure_activity_success(event),
        ]
    )


def title(event):
    resource_id = event.get("resourceId", "")
    storage_account = extract_resource_name_from_id(
        resource_id, "storageAccounts", default="<UNKNOWN_ACCOUNT>"
    )
    return f"Azure Storage Account HTTPS-only traffic disabled on [{storage_account}]"


def alert_context(event):
    context = azure_activity_alert_context(event)
    return context