AZT704.2 - Soft-Delete Recovery: Storage Account Object

An adversary may recover a storage account object found in a 'soft deletion' state.

Resource

Azure Storage Account

Actions

• Microsoft.Storage/storageAccounts/blobServices/\/

Examples

Azure REST APIAzure Portal

• Invoke-RESTMethod -Uri https://myaccount.blob.core.windows.net/mycontainer/myblob?comp=undelete -Method PUT

• Invoke-RESTMethod -Uri https://myaccount.blob.core.windows.net/destinationcontainer?restype=container&comp=undelete -Method PUT

Detections

Logs

Data Source	Operation Name	Action	Log Provider
Resource	RestoreContainer	Microsoft.Storage/storageAccounts/blobServices/\/	StorageBlobLogs

Queries

Platform	Query
Log Analytics	StorageBlobLogs | where OperationName == 'RestoreContainer'

Additional Resources

• https://docs.microsoft.com/en-us/azure/storage/blobs/soft-delete-blob-overview