Skill Market

detecting azure storage account misconfigurations

Audit Azure Blob and ADLS storage accounts for public access exposure, weak or long-lived SAS tokens, missing

GitHub
githubcommunityai-agentsclaude-codecloud-securitycybersecuritydevsecopsethical-hacking
0.0
0 installs33.4K GitHub starsby mukul975

Skill Introduction

Overview
Audit Azure Blob and ADLS storage accounts for public access exposure, weak or long-lived SAS tokens, missing

Core value

Turns reusable Other know-how into an installable skill, helping users complete github, community, ai-agents, claude-code work faster.

Target users

  • Developers, testers, and maintainers who handle Other tasks in Focus Code.
  • Teams that already trust workflows or content from mukul975.
  • Users who want standardized prompts, steps, or conventions instead of repeating setup work.

Best practices

  • Read the skill content first to confirm required inputs, expected outputs, and dependencies.
  • Try it on a small task before relying on it for critical work.
  • Add project-specific constraints such as coding style, target platform, test expectations, and delivery format.
  • For external sources, verify the source link, version, and recent maintenance activity.

Best use cases

  • Tasks related to github, community, ai-agents, claude-code that need a reusable execution flow.
  • Converting a community repo, team convention, or personal workflow into day-to-day assistance.
  • Starting from a proven skill instead of writing prompts or procedures from scratch.

Limits and boundaries

  • Results depend on the quality of the original skill content and may need human correction.
  • It does not replace code review, tests, security review, or professional judgment.
  • External tools, APIs, account permissions, and local dependencies still need separate setup.

Differentiation

  • Structured around Other, making it easier to discover and reuse than loose prompt snippets.
  • Marked as GitHub, which helps users judge trust and maintenance expectations.
  • Keeps the original source link available for repository, documentation, or discussion follow-up.
  • Tagged with github, community, ai-agents, claude-code, so it can be filtered by concrete task intent.

Install and use

Install
Copy Install Command
focus install detecting-azure-storage-account-misconfigurations-451284
View source

Detail Preview

SKILL.md

Primary filemarkdown3 KB

name: detecting-azure-storage-account-misconfigurations description: Audit Azure Blob and ADLS storage accounts for public access exposure, weak or long-lived SAS tokens, missing encryption at rest, disabled HTTPS-only traffic, and outdated TLS versions using the azure-mgmt-storage Python SDK. domain: cybersecurity subdomain: cloud-security tags:

  • Azure
  • storage-accounts
  • blob-storage
  • ADLS
  • SAS-tokens
  • encryption
  • public-access
  • cloud-misconfiguration
  • azure-mgmt-storage version: '1.0' author: mahipal license: Apache-2.0 nist_ai_rmf:
  • MEASURE-2.7
  • MAP-5.1
  • MANAGE-2.4 atlas_techniques:
  • AML.T0070
  • AML.T0066
  • AML.T0082 nist_csf:
  • PR.IR-01
  • ID.AM-08
  • GV.SC-06
  • DE.CM-01

Detecting Azure Storage Account Misconfigurations

Overview

Azure Storage accounts are a frequent target for attackers due to misconfigured public access, long-lived SAS tokens, missing encryption, and outdated TLS versions. This skill uses the azure-mgmt-storage Python SDK with StorageManagementClient to enumerate all storage accounts in a subscription, inspect their security properties, list blob containers for public access settings, and generate a risk-scored audit report identifying critical misconfigurations.

When to Use

  • When investigating security incidents that require detecting azure storage account misconfigurations
  • When building detection rules or threat hunting queries for this domain
  • When SOC analysts need structured procedures for this analysis type
  • When validating security monitoring coverage for related attack techniques

Prerequisites

  • Python 3.9+ with azure-mgmt-storage, azure-identity
  • Azure service principal with Reader role on target subscription
  • Environment variables: AZURE_CLIENT_ID, AZURE_TENANT_ID, AZURE_CLIENT_SECRET, AZURE_SUBSCRIPTION_ID

Key Detection Areas

  1. Public blob access — allow_blob_public_access enabled on storage account or individual containers set to Blob/Container access level
  2. HTTPS enforcement — enable_https_traffic_only disabled, allowing unencrypted HTTP traffic
  3. Minimum TLS version — accounts accepting TLS 1.0 or TLS 1.1 instead of minimum TLS 1.2
  4. Encryption at rest — storage service encryption not enabled or missing customer-managed keys
  5. Network rules — default action set to Allow instead of Deny, exposing storage to all networks
  6. SAS token risks — account-level SAS with overly broad permissions or excessive lifetime

Output

JSON report with per-account findings, severity ratings (Critical/High/Medium/Low), and remediation recommendations aligned with CIS Azure Benchmark controls.

Reviews

Overall rating

0.0
0.0

0 comments

No reviews yet