Azure Storage SAS Exfiltration via listKeys then New-IP Blob Access

Ankit Mehta@Secvyn

•updated Jun 30, 2026•1•0•2

This rule detects potential unauthorized access to Azure Storage Blobs following the retrieval of storage account access keys. It correlates 'ListKeys' API events with subsequent blob access activities from either unrecognized IP addresses or via Shared Access Signature (SAS) tokens, indicating potential credential misuse.