# Analyzing Cloud Storage Access Patterns

> Detect abnormal access patterns in Azure Blob Storage by analyzing Storage Analytics and diagnostic logs. Identifies after-hours bulk downloads, access from new IP addresses, unusual API calls (GetBlob spikes), and potential data exfiltration.

- Skill: `owasp/analyzing-cloud-storage-access-patterns` (Agent Skill)
- Install (CLI): `npx skillmds@latest add owasp/analyzing-cloud-storage-access-patterns`
- Raw SKILL.md: https://api.skillmd.com/api/skills/owasp/analyzing-cloud-storage-access-patterns/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- License: Apache-2.0
- Author: OWASP (https://skillmd.com/u/owasp)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/owasp/analyzing-cloud-storage-access-patterns

---


# Analyzing Cloud Storage Access Patterns — Azure Focused

## When to Use
- When investigating potential data exfiltration from Azure Storage Accounts.
- When building KQL hunting queries for Storage account activity.
- When validating if access to sensitive blobs follows established baselines.
- When performing security audits of Storage SAS token usage and public access.

## Key Concepts

| Term | Definition |
|------|------------|
| Storage Analytics | Azure feature that provides logs and metrics for storage accounts |
| Diagnostic Settings | Configuration to send storage logs to Log Analytics or Event Hub |
| SAS Token | Shared Access Signature, providing temporary delegated access to storage |
| Data Exfiltration | Unauthorized transfer of data from a storage account to an external system |

## OpenShield Storage Rules

| Rule | Description | Severity |
|------|-------------|----------|
| AZ-STOR-001 | Public Blob Access Enabled on Storage Account | HIGH |
| AZ-STOR-004 | Storage Account Diagnostic Logging Disabled | MEDIUM |
| AZ-STOR-002 | Storage Account Allows HTTP Traffic | MEDIUM |
| AZ-STOR-003 | Storage Account Has No Lifecycle Management Policy | LOW |

## Analysis Workflow

### Step 1: Enable and Query Diagnostic Logs
Ensure logs are sent to Log Analytics and use KQL to identify spikes.

```kql
// Identify bulk GetBlob operations from a single IP
StorageBlobLogs
| where OperationName == "GetBlob"
| summarize RequestCount = count() by CallerIpAddress, bin(TimeGenerated, 1h)
| where RequestCount > 100
```

### Step 2: Build Access Baselines
Monitor for access from new source IPs or unusual hours.

### Step 3: Detect Anomalies
- **Spikes**: Sudden increase in `GetBlob` or `ListBlobs` calls.
- **Geography**: Access from IPs in countries where the organization does not operate.
- **Success/Failure Ratio**: High number of `403 Forbidden` errors indicating enumeration.

## Remediation Reference
- **Disable Public Access**: Use `az storage account update --allow-blob-public-access false`.
- **Enforce HTTPS**: Use `az storage account update --https-only true`.
- **Use Private Endpoints**: Restrict storage access to internal VNet traffic only.