Azure Storage Blob Misconfiguration Check
Query
// Azure Resource Graph
// Azure Storage Blob - Misconfiguration Check
// https://www.linkedin.com/posts/activity-7184079321605529600-Obcd/
resources
| where type == "Microsoft.Storage/storageAccounts"
| extend allowBlobPublicAccess = parse_json(properties).allowBlobPublicAccess
| project subscriptionId, resourceGroup, name, allowBlobPublicAccess
// MITRE ATT&CK Mapping
// The query is primarily focused on identifying misconfigurations that could lead to unauthorized access. The relevant MITRE ATT&CK techniques include:
// T1530 - Data from Cloud Storage Object: This technique involves adversaries accessing data stored in cloud storage services. By identifying storage accounts with public blob access, you can detect potential exposure of sensitive data1.Explanation
This query is designed to identify potential misconfigurations in Azure Storage Accounts that could lead to unauthorized access. It specifically checks if the storage accounts allow public access to blobs, which could expose sensitive data. Here's a simple breakdown of what the query does:
-
Target Resource Type: It looks at resources of the type "Microsoft.Storage/storageAccounts" within Azure.
-
Check for Public Access: It extracts the property
allowBlobPublicAccessfrom each storage account's properties to determine if public access to blobs is allowed. -
Output Information: The query then lists the subscription ID, resource group, storage account name, and whether public blob access is allowed for each storage account.
-
Security Implication: Allowing public access to blobs can lead to unauthorized access to data, which is a security risk. This is related to the MITRE ATT&CK technique T1530, where adversaries might access data from cloud storage objects.
In summary, this query helps identify storage accounts that might be misconfigured to allow public access, potentially exposing sensitive data to unauthorized users.
Details
Steven Lim
Released: August 25, 2024
Tables
Keywords
Operators
MITRE Techniques