[metadata]
creation_date = "2020/08/19"
maturity = "production"
updated_date = "2020/12/15"

[rule]
author = ["Elastic"]
description = """
Identifies a rotation to storage account access keys in Azure. Regenerating access keys can affect any applications or
Azure services that are dependent on the storage account key. Adversaries may regenerate a key as a means of acquiring
credentials to access systems and resources.
"""
false_positives = [
    """
    It's recommended that you rotate your access keys periodically to help keep your storage account secure. Normal key
    rotation can be exempted from the rule. An abnormal time frame and/or a key rotation from unfamiliar users, hosts,
    or locations should be investigated.
    """,
]
from = "now-25m"
index = ["filebeat-*", "logs-azure*"]
language = "kuery"
license = "Elastic License"
name = "Azure Storage Account Key Regenerated"
note = "The Azure Filebeat module must be enabled to use this rule."
references = [
    "https://docs.microsoft.com/en-us/azure/storage/common/storage-account-keys-manage?tabs=azure-portal",
]
risk_score = 21
rule_id = "1e0b832e-957e-43ae-b319-db82d228c908"
severity = "low"
tags = ["Elastic", "Cloud", "Azure", "Continuous Monitoring", "SecOps", "Identity and Access"]
type = "query"

query = '''
event.dataset:azure.activitylogs and azure.activitylogs.operation_name:MICROSOFT.STORAGE/STORAGEACCOUNTS/REGENERATEKEY/ACTION and event.outcome:(Success or success)
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1528"
name = "Steal Application Access Token"
reference = "https://attack.mitre.org/techniques/T1528/"


[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

