Azure Storage Account Key Regenerated

AnalysisType: rule
Filename: azure_storage_account_key_regenerated.py
RuleID: "Azure.MonitorActivity.StorageAccount.KeyRegenerated"
DisplayName: "Azure Storage Account Key Regenerated"
Enabled: true
LogTypes:
  - Azure.MonitorActivity
Severity: Info
Description: >
  Detects when an Azure storage account access key is regenerated.
  Key regeneration is a normal operational activity but may indicate an attacker attempting to maintain persistence or rotate credentials after compromise.
Reports:
  MITRE ATT&CK:
    - TA0006:T1098 # Persistence: Account Manipulation
Tags:
  - Persistence
  - Account Manipulation
Runbook: |
  1. Query Azure Monitor Activity logs for all storage account operations by the callerIpAddress in the 24 hours before and after this alert to identify suspicious patterns
  2. Check if the source IP is associated with known cloud providers, VPN services, or corporate network ranges using threat intelligence
  3. Search for other Azure storage account modifications, key regenerations, or access events from the same user or IP in the past 7 days to assess if this is part of unauthorized activity
Reference: https://www.elastic.co/guide/en/security/8.19/azure-storage-account-key-regenerated.html
SummaryAttributes:
  - resourceId
  - callerIpAddress
  - correlationId
Tests:
  - Name: Key Regenerated
    ExpectedResult: true
    Log:
      {
        "time": "2024-12-17T10:30:00.0000000Z",
        "resourceId": "/subscriptions/12345678-1234-1234-1234-123456789abc/resourceGroups/myresourcegroup/providers/Microsoft.Storage/storageAccounts/mystorageaccount",
        "operationName": "Microsoft.Storage/storageAccounts/regenerateKey/action",
        "operationVersion": "2021-04-01",
        "category": "Administrative",
        "resultType": "Success",
        "resultSignature": "200",
        "durationMs": 523,
        "callerIpAddress": "1.1.1.1",
        "correlationId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
        "level": "Informational",
        "location": "eastus",
        "properties": {
          "requestbody": {
            "keyName": "key1"
          }
        },
        "tenantId": "87654321-4321-4321-4321-111111111111"
      }
  - Name: Case Insensitive Match
    ExpectedResult: true
    Log:
      {
        "time": "2024-12-17T11:45:00.0000000Z",
        "resourceId": "/subscriptions/12345678-1234-1234-1234-123456789abc/resourceGroups/prod-rg/providers/Microsoft.Storage/storageAccounts/prodstorage",
        "operationName": "microsoft.storage/storageaccounts/regeneratekey/action",
        "operationVersion": "2021-04-01",
        "category": "Administrative",
        "resultType": "Succeeded",
        "callerIpAddress": "1.2.3.4",
        "correlationId": "f9e8d7c6-b5a4-3210-9876-fedcba098765",
        "properties": {
          "requestbody": {
            "keyName": "key2"
          }
        },
        "tenantId": "87654321-4321-4321-4321-111111111111"
      }
  - Name: Different Operation
    ExpectedResult: false
    Log:
      {
        "time": "2024-12-17T13:30:00.0000000Z",
        "resourceId": "/subscriptions/12345678-1234-1234-1234-123456789abc/resourceGroups/myresourcegroup/providers/Microsoft.Storage/storageAccounts/mystorageaccount",
        "operationName": "Microsoft.Storage/storageAccounts/write",
        "operationVersion": "2021-04-01",
        "category": "Administrative",
        "resultType": "Success",
        "callerIpAddress": "3.3.3.3",
        "correlationId": "d4e5f6a7-b8c9-0123-def0-444444444444",
        "tenantId": "87654321-4321-4321-4321-111111111111"
      }

# ------ paired body: azure_storage_account_key_regenerated.py ------

from panther_azureactivity_helpers import (
    azure_activity_alert_context,
    azure_activity_success,
    azure_parse_json_string,
    extract_resource_name_from_id,
)

REGENERATE_KEY = "MICROSOFT.STORAGE/STORAGEACCOUNTS/REGENERATEKEY/ACTION"


def rule(event):
    return event.get("operationName", "").upper() == REGENERATE_KEY and azure_activity_success(
        event
    )


def title(event):
    resource_id = event.get("resourceId", "")
    storage_account = extract_resource_name_from_id(
        resource_id, "storageAccounts", default="<UNKNOWN_ACCOUNT>"
    )
    requestbody = azure_parse_json_string(event.deep_get("properties", "requestbody", default=None))
    key = requestbody.get("keyName", "<UNKNOWN_KEY>")
    return f"Azure Storage Account key [{key}] regenerated on [{storage_account}]"


def alert_context(event):
    context = azure_activity_alert_context(event)
    requestbody = azure_parse_json_string(event.deep_get("properties", "requestbody", default=None))
    context["key_name"] = requestbody.get("keyName", "<UNKNOWN_KEY>")
    return context