Azure Storage Account Shared Key Access Enabled

AnalysisType: rule
Filename: azure_storage_account_key_access_enabled.py
RuleID: "Azure.MonitorActivity.StorageAccount.SharedKeyAccessEnabled"
DisplayName: "Azure Storage Account Shared Key Access Enabled"
Enabled: true
LogTypes:
  - Azure.MonitorActivity
Severity: Medium
Description: >
  Detects when an existing Azure storage account's shared key access is enabled (allowSharedKeyAccess: true).
  Shared key access uses storage account keys for authentication, which is less secure than Azure AD-based authentication.
Reports:
  MITRE ATT&CK:
    - TA0006:T1098 # Persistence: Account Manipulation
Tags:
  - Persistence
  - Account Manipulation
Runbook: |
  1. Query Azure Monitor Activity logs for all storage account operations by the callerIpAddress in the 6 hours before and after this alert to identify patterns
  2. Check if the source IP is associated with known cloud providers, VPN services, or corporate network ranges using threat intelligence
  3. Search for other Azure storage account configuration changes or data access events from the same user or IP in the past 7 days to assess risk
Reference: https://orca.security/resources/blog/azure-shared-key-authorization-exploitation/
SummaryAttributes:
  - resourceId
  - callerIpAddress
  - correlationId
Tests:
  - Name: Shared Key Access Enabled
    ExpectedResult: true
    Log:
      {
        "time": "2024-12-17T10:30:00.0000000Z",
        "resourceId": "/subscriptions/12345678-1234-1234-1234-123456789abc/resourceGroups/myresourcegroup/providers/Microsoft.Storage/storageAccounts/mystorageaccount",
        "operationName": "Microsoft.Storage/storageAccounts/write",
        "operationVersion": "2021-04-01",
        "category": "Administrative",
        "resultType": "Success",
        "resultSignature": "200",
        "durationMs": 1523,
        "callerIpAddress": "1.1.1.1",
        "correlationId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
        "identity": {
          "claims": {
            "name": "denethor@lotr.com"
          }
        },
        "level": "Informational",
        "location": "eastus",
        "properties": {
          "requestbody": "{\"properties\":{\"allowSharedKeyAccess\":true}}"
        },
        "tenantId": "87654321-4321-4321-4321-111111111111"
      }
  - Name: Case Insensitive Match
    ExpectedResult: true
    Log:
      {
        "time": "2024-12-17T11:45:00.0000000Z",
        "resourceId": "/subscriptions/12345678-1234-1234-1234-123456789abc/resourceGroups/prod-rg/providers/Microsoft.Storage/storageAccounts/prodstorage",
        "operationName": "microsoft.storage/storageaccounts/write",
        "operationVersion": "2021-04-01",
        "category": "Administrative",
        "resultType": "Succeeded",
        "callerIpAddress": "1.2.3.4",
        "correlationId": "f9e8d7c6-b5a4-3210-9876-fedcba098765",
        "properties": {
          "requestbody": "{\"properties\":{\"allowSharedKeyAccess\":true}}"
        },
        "tenantId": "87654321-4321-4321-4321-111111111111"
      }
  - Name: Different Operation
    ExpectedResult: false
    Log:
      {
        "time": "2024-12-17T13:30:00.0000000Z",
        "resourceId": "/subscriptions/12345678-1234-1234-1234-123456789abc/resourceGroups/myresourcegroup/providers/Microsoft.Storage/storageAccounts/mystorageaccount",
        "operationName": "Microsoft.Storage/storageAccounts/delete",
        "operationVersion": "2021-04-01",
        "category": "Administrative",
        "resultType": "Success",
        "callerIpAddress": "3.3.3.3",
        "correlationId": "d4e5f6a7-b8c9-0123-def0-444444444444",
        "tenantId": "87654321-4321-4321-4321-111111111111"
      }

# ------ paired body: azure_storage_account_key_access_enabled.py ------

from panther_azureactivity_helpers import (
    azure_activity_alert_context,
    azure_activity_success,
    azure_parse_json_string,
    extract_resource_name_from_id,
)

STORAGE_ACCOUNT_WRITE = "MICROSOFT.STORAGE/STORAGEACCOUNTS/WRITE"


def rule(event):
    requestbody = azure_parse_json_string(event.deep_get("properties", "requestbody", default=None))
    return all(
        [
            event.get("operationName", "").upper() == STORAGE_ACCOUNT_WRITE,
            requestbody.get("properties", {}).get("allowSharedKeyAccess") is True,
            requestbody.get("location") is None,
            azure_activity_success(event),
        ]
    )


def title(event):
    resource_id = event.get("resourceId", "")
    storage_account = extract_resource_name_from_id(
        resource_id, "storageAccounts", default="<UNKNOWN_ACCOUNT>"
    )
    return f"Azure Storage Account shared key access enabled on [{storage_account}]"


def alert_context(event):
    context = azure_activity_alert_context(event)
    return context