Analyzing Cloud Storage Access Patterns

Analyzing Cloud Storage Access Patterns — Azure Focused

When to Use

• When investigating potential data exfiltration from Azure Storage Accounts.
• When building KQL hunting queries for Storage account activity.
• When validating if access to sensitive blobs follows established baselines.
• When performing security audits of Storage SAS token usage and public access.

Key Concepts

OpenShield Storage Rules

Analysis Workflow

Step 1: Enable and Query Diagnostic Logs

Ensure logs are sent to Log Analytics and use KQL to identify spikes.

// Identify bulk GetBlob operations from a single IP
StorageBlobLogs
| where OperationName == "GetBlob"
| summarize RequestCount = count() by CallerIpAddress, bin(TimeGenerated, 1h)
| where RequestCount > 100

Step 2: Build Access Baselines

Monitor for access from new source IPs or unusual hours.

Step 3: Detect Anomalies

• Spikes: Sudden increase in GetBlob or ListBlobs calls.
• Geography: Access from IPs in countries where the organization does not operate.
• Success/Failure Ratio: High number of 403 Forbidden errors indicating enumeration.

Remediation Reference

• Disable Public Access: Use az storage account update --allow-blob-public-access false.
• Enforce HTTPS: Use az storage account update --https-only true.
• Use Private Endpoints: Restrict storage access to internal VNet traffic only.