Elastic Security Detection Rules

Azure Storage Anonymous Blob Access to Unusual Resource

Last updated a month ago on 2026-08-17
Created a month ago on 2026-08-17

About

Identifies the first time an Azure Storage resource receives an anonymous data-plane read (GetBlob and related Get or List operations). Anonymous requests are used to probe public containers and to test stolen blob URLs before a SAS is appended. First-seen resource ID keeps volume down while still covering WireServer-related probes of status or extension blobs.
Tags
Domain: CloudData Source: AzureData Source: Azure Platform LogsPlatform: AzureService: Azure StorageUse Case: Threat DetectionTactic: DiscoveryTactic: CollectionLanguage: kuery
Severity
medium
Risk Score
47
MITRE ATT&CK™

Discovery (TA0007)(external, opens in a new tab or window)

↳ Cloud Infrastructure Discovery (T1580)(external, opens in a new tab or window)

Collection (TA0009)(external, opens in a new tab or window)

↳ Data from Cloud Storage (T1530)(external, opens in a new tab or window)

False Positive Examples
Intentionally public containers (static websites, public datasets) generate anonymous GetBlob and ListBlobs. Baseline those storage accounts and exclude `azure.resource.id` after review. Internet-wide scanners will produce first-seen anonymous access on newly created or newly logged accounts. Confirm whether the account is meant to be public.
License
Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type
New Terms Rule
Integration Pack
Prebuilt Security Detection Rules
Index Patterns
logs-azure.platformlogs-*
Related Integrations

azure(external, opens in a new tab or window)

Query
text code block:
data_stream.dataset: azure.platformlogs and
    azure.platformlogs.identity.type: Anonymous and
    event.action: (
        GetBlob or GetBlobMetadata or GetBlobProperties or GetBlockList or
        GetPageRanges or QueryBlobContents or ListBlobs or
        GetContainerProperties or GetContainerMetadata or GetContainerAcl
    )

Install detection rules in Elastic Security

Detect Azure Storage Anonymous Blob Access to Unusual Resource in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).