SFTP account

Info

ID: MS-T809
Tactic: Persistence
MITRE technique:

Attackers may create an SFTP account to maintain access to a target storage account. The SFTP account is local on the storage instance and is not subject to Azure RBAC permissions. The account is also unaffected in case of storage account access keys rotation.