Azure Storage Account Public Network Access Enabled

AnalysisType: rule
Filename: azure_storage_account_public_network_access_enabled.py
RuleID: "Azure.MonitorActivity.StorageAccount.PublicNetworkAccessEnabled"
DisplayName: "Azure Storage Account Public Network Access Enabled"
Enabled: true
LogTypes:
  - Azure.MonitorActivity
Severity: High
Description: >
  Detects when an existing Azure storage account's network settings are modified to enable public network access.
  This could indicate a potential data exfiltration risk or misconfiguration.
Reports:
  MITRE ATT&CK:
    - TA0010:T1567 # Exfiltration: Exfiltration Over Web Service
Tags:
  - Exfiltration
  - Exfiltration Over Web Service
Runbook: |
  1. Query Azure Monitor Activity logs for all storage account operations by the callerIpAddress in the 6 hours before and after this alert to establish activity patterns
  2. Check if the source IP is associated with known cloud providers, VPN services, or corporate network ranges using threat intelligence
  3. Search for other Azure storage account modifications or data access events from the same user or IP in the past 7 days to identify potential data exfiltration campaigns
Reference: https://www.mitiga.io/blog/ransomware-strikes-azure-storage-are-you-ready
SummaryAttributes:
  - resourceId
  - callerIpAddress
  - correlationId
Tests:
  - Name: Public Access Enabled
    ExpectedResult: true
    Log:
      {
        "time": "2024-12-17T10:30:00.0000000Z",
        "resourceId": "/subscriptions/12345678-1234-1234-1234-123456789abc/resourceGroups/myresourcegroup/providers/Microsoft.Storage/storageAccounts/mystorageaccount",
        "operationName": "Microsoft.Storage/storageAccounts/write",
        "operationVersion": "2021-04-01",
        "category": "Administrative",
        "resultType": "Success",
        "resultSignature": "200",
        "durationMs": 1523,
        "callerIpAddress": "1.1.1.1",
        "correlationId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
        "identity": {
          "claims": {
            "name": "denethor@lotr.com"
          }
        },
        "level": "Informational",
        "location": "eastus",
        "properties": {
          "requestbody": "{\"properties\":{\"networkAcls\":{\"defaultAction\":\"Allow\",\"bypass\":\"AzureServices\",\"virtualNetworkRules\":[],\"ipRules\":[]}}}"
        },
        "tenantId": "87654321-4321-4321-4321-111111111111"
      }
  - Name: Case Insensitive Match
    ExpectedResult: true
    Log:
      {
        "time": "2024-12-17T11:45:00.0000000Z",
        "resourceId": "/subscriptions/12345678-1234-1234-1234-123456789abc/resourceGroups/prod-rg/providers/Microsoft.Storage/storageAccounts/prodstorage",
        "operationName": "microsoft.storage/storageaccounts/write",
        "operationVersion": "2021-04-01",
        "category": "Administrative",
        "resultType": "Succeeded",
        "callerIpAddress": "1.2.3.4",
        "correlationId": "f9e8d7c6-b5a4-3210-9876-fedcba098765",
        "properties": {
          "requestbody": "{\"properties\":{\"networkAcls\":{\"defaultAction\":\"Allow\"}}}"
        },
        "tenantId": "87654321-4321-4321-4321-111111111111"
      }
  - Name: Different Operation
    ExpectedResult: false
    Log:
      {
        "time": "2024-12-17T09:15:00.0000000Z",
        "resourceId": "/subscriptions/12345678-1234-1234-1234-123456789abc/resourceGroups/myresourcegroup/providers/Microsoft.Storage/storageAccounts/newstorageaccount",
        "operationName": "Microsoft.Storage/storageAccounts/write",
        "operationVersion": "2021-04-01",
        "category": "Administrative",
        "resultType": "Success",
        "callerIpAddress": "4.4.4.4",
        "correlationId": "b2c3d4e5-f6a7-8901-bcde-f12345678901",
        "properties": {
          "requestbody": "{\"location\":\"westus\",\"properties\":{\"networkAcls\":{\"defaultAction\":\"Allow\"}}}"
        },
        "tenantId": "87654321-4321-4321-4321-111111111111"
      }

# ------ paired body: azure_storage_account_public_network_access_enabled.py ------

from panther_azureactivity_helpers import (
    azure_activity_alert_context,
    azure_activity_success,
    azure_parse_json_string,
    extract_resource_name_from_id,
)

STORAGE_ACCOUNT_WRITE = "MICROSOFT.STORAGE/STORAGEACCOUNTS/WRITE"


def rule(event):
    requestbody = azure_parse_json_string(event.deep_get("properties", "requestbody", default=None))
    return all(
        [
            event.get("operationName", "").upper() == STORAGE_ACCOUNT_WRITE,
            requestbody.get("properties", {}).get("networkAcls", {}).get("defaultAction")
            == "Allow",
            requestbody.get("location") is None,
            azure_activity_success(event),
        ]
    )


def title(event):
    resource_id = event.get("resourceId", "")
    storage_account = extract_resource_name_from_id(
        resource_id, "storageAccounts", default="<UNKNOWN_ACCOUNT>"
    )

    return f"Azure Storage Account public network access enabled on [{storage_account}] "


def alert_context(event):
    context = azure_activity_alert_context(event)
    return context