Classification:

attack

Tactic:

TA0010-exfiltration

Technique:

T1530-data-from-cloud-storage

VIEW RULE IN DATADOG VIEW SIGNALS

Goal

Detect an anomalous volume of Azure Storage download requests originating from the AzCopy command-line utility.

Strategy

This rule monitors Azure Storage logs for GetBlob and GetFile operations where the user agent contains AzCopy, grouped by source IP address. It uses anomaly detection to identify unusual spikes in download volume from a 24-hour baseline. AzCopy is a legitimate Microsoft utility for transferring data to and from Azure Storage, but attackers who have obtained valid credentials may use it to exfiltrate large volumes of data from storage accounts due to its support for bulk parallel transfers.

Triage and response

• Identify the source IP {{@ocsf.src_endpoint.ip}} and determine if it belongs to a known internal service, CI/CD pipeline, or authorized user.
• Review the storage accounts and containers targeted by the download requests to assess the sensitivity of the accessed data.
• Check whether the volume of downloads correlates with a known scheduled job such as a backup, migration, or data sync operation.
• Examine Microsoft Entra ID sign-in logs for the associated identity to determine if the session was established through normal authentication or if the credentials used to establish the session may have been compromised.
• Determine if the source IP has been observed performing other unusual storage operations such as listing containers or accessing storage accounts it does not normally interact with.