Azure snapshot export URI created

azure

Classification:

attack

Tactic:

TA0009-collection

Technique:

T1074-data-staged

Set up the azure integration.

このページは日本語には対応しておりません。随時翻訳に取り組んでいます。翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。

Goal

Detect if an Azure snapshot is exported. Export URLs generated in Azure are accessible to anyone with the URL.

Strategy

Monitor Azure logs where @evt.name is "MICROSOFT.COMPUTE/SNAPSHOTS/BEGINGETACCESS/ACTION" and @evt.outcome is Success.

Triage and response

  1. Verify the snapshot (@resourceId) has a legitimate reason for being exported.
  2. If the activity is not expected, investigate the activity around the IP ({{@network.client.ip}}) creating the export URL.