-
Notifications
You must be signed in to change notification settings - Fork 479
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
[New Rule] Azure Storage Account Key Regenerated (#188)
* Create credential_access_storage_account_key_regenerated.toml * Update rules/azure/credential_access_storage_account_key_regenerated.toml Co-authored-by: David French <56409778+threat-punter@users.noreply.github.com> * Update credential_access_storage_account_key_regenerated.toml Co-authored-by: David French <56409778+threat-punter@users.noreply.github.com>
- Loading branch information
1 parent
040f56f
commit 140091e
Showing
1 changed file
with
53 additions
and
0 deletions.
There are no files selected for viewing
53 changes: 53 additions & 0 deletions
53
rules/azure/credential_access_storage_account_key_regenerated.toml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,53 @@ | ||
[metadata] | ||
creation_date = "2020/08/19" | ||
ecs_version = ["1.6.0"] | ||
maturity = "production" | ||
updated_date = "2020/08/19" | ||
|
||
[rule] | ||
author = ["Elastic"] | ||
description = """ | ||
Identifies a rotation to storage account access keys in Azure. Regenerating access keys can affect any applications or | ||
Azure services that are dependent on the storage account key. Adversaries may regenerate a key as a means of acquiring | ||
credentials to access systems and resources. | ||
""" | ||
false_positives = [ | ||
""" | ||
It's recommended that you rotate your access keys periodically to help keep your storage account secure. Normal key | ||
rotation can be exempted from the rule. An abnormal time frame and/or a key rotation from unfamiliar users, hosts, | ||
or locations should be investigated. | ||
""", | ||
] | ||
from = "now-25m" | ||
index = ["filebeat-*"] | ||
language = "kuery" | ||
license = "Elastic License" | ||
name = "Azure Storage Account Key Regenerated" | ||
note = "The Azure Filebeat module must be enabled to use this rule." | ||
references = [ | ||
"https://docs.microsoft.com/en-us/azure/storage/common/storage-account-keys-manage?tabs=azure-portal", | ||
] | ||
risk_score = 21 | ||
rule_id = "1e0b832e-957e-43ae-b319-db82d228c908" | ||
severity = "low" | ||
tags = ["Azure", "Elastic", "SecOps", "Continuous Monitoring", "Identity and Access"] | ||
type = "query" | ||
|
||
query = ''' | ||
event.module:azure and event.dataset:azure.activitylogs and event.category:Administrative and azure.activitylogs.operation_name:MICROSOFT.STORAGE/STORAGEACCOUNTS/REGENERATEKEY/ACTION and event.outcome:Success | ||
''' | ||
|
||
|
||
[[rule.threat]] | ||
framework = "MITRE ATT&CK" | ||
[[rule.threat.technique]] | ||
id = "T1528" | ||
name = "Steal Application Access Token" | ||
reference = "https://attack.mitre.org/techniques/T1528/" | ||
|
||
|
||
[rule.threat.tactic] | ||
id = "TA0006" | ||
name = "Credential Access" | ||
reference = "https://attack.mitre.org/tactics/TA0006/" | ||
|