Skip to content

AZT703.1 - Replication: Storage Account Replication#

By setting up cross-tenant replication, an adversary may set up replication from one tenant's storage account to an extrenal tenant's storage account.

Resource

Azure Storage Account

Actions

  • Microsoft.Storage/storageAccounts/write

Detections

Detection Details#

A policy can be created to alert when replication is set up.

Logs#

Data Source Operation Name Action Log Location
Resource Put Object Replication Policy Microsoft.Storage/storageAccounts/objectReplicationPolicies/write Azure Activity Log

Queries#

 |where OperationNameValue=="Microsoft.Storage/storageAccounts/objectReplicationPolicies/write"