Detecting Azure Storage Account Misconfigurations
FreeAudit and secure your Azure storage accounts effectively.
Free · Opens the source repo
What Detecting Azure Storage Account Misconfigurations does
This skill is designed to help security professionals audit Azure Storage accounts for common misconfigurations that can lead to data exposure or security incidents. Utilizing the azure-mgmt-storage Python SDK, it inspects various security properties of storage accounts, including public access settings, SAS token configurations, and encryption status. By enumerating all storage accounts in a specified Azure subscription, it provides a comprehensive overview of potential vulnerabilities that need addressing.
The skill focuses on several critical detection areas, such as ensuring that public blob access is properly restricted, enforcing HTTPS traffic, and maintaining up-to-date TLS versions. It also checks for the presence of encryption at rest and evaluates network rules to prevent unauthorized access. By generating a risk-scored audit report, users can easily identify which accounts require immediate attention and what remediation steps are recommended, aligned with established security benchmarks like the CIS Azure Benchmark.
This tool is particularly useful for security operations center (SOC) analysts, cloud security architects, and incident response teams. It aids in threat hunting and provides structured procedures for assessing Azure storage configurations. The output is a detailed JSON report that categorizes findings by severity, making it straightforward to prioritize remediation efforts based on risk levels.
In summary, this skill not only helps in identifying misconfigurations but also serves as a valuable resource for enhancing the overall security posture of Azure environments. By using this skill, organizations can proactively mitigate risks associated with their cloud storage solutions.
When to use it
Use this skill when auditing Azure storage accounts for security compliance or investigating potential security incidents.
When not to use it
This skill is not suitable for environments that do not utilize Azure or for users who are not familiar with Python scripting and Azure SDKs.
What you can build with it
Investigating Security Incidents
Use this skill to quickly assess Azure storage accounts when a security incident is suspected, identifying potential misconfigurations.
Building Detection Rules
Incorporate this skill into your threat hunting queries to establish detection rules for Azure storage account vulnerabilities.
Validating Security Monitoring Coverage
Employ this skill to ensure your security monitoring tools are effectively covering Azure storage account configurations.
How to install Detecting Azure Storage Account Misconfigurations
View source1. Install with the skills CLI
npx skills add mukul975/anthropic-cybersecurity-skills/detecting-azure-storage-account-misconfigurations --agent claude-code2. Or install it manually
Download the skill folder and drop it into ~/.claude/skills/ for all projects, or .claude/skills/ to scope it to one repo. Restart Claude Code so it picks up the new skill.
Anthropic's agentic coding CLI, and the reference implementation of Agent Skills. Drop a skill folder into ~/.claude/skills and Claude Code loads it automatically whenever a task matches the skill's description. Claude Code docs
Inside SKILL.md
Written by mukul975Detecting Azure Storage Account Misconfigurations
Overview
Azure Storage accounts are a frequent target for attackers due to misconfigured public access, long-lived SAS tokens, missing encryption, and outdated TLS versions. This skill uses the azure-mgmt-storage Python SDK with StorageManagementClient to enumerate all storage accounts in a subscription, inspect their security properties, list blob containers for public access settings, and generate a risk-scored audit report identifying critical misconfigurations.
When to Use
- When investigating security incidents that require detecting azure storage account misconfigurations
- When building detection rules or threat hunting queries for this domain
- When SOC analysts need structured procedures for this analysis type
- When validating security monitoring coverage for related attack techniques
Prerequisites
- Python 3.9+ with
azure-mgmt-storage,azure-identity - Azure service principal with Reader role on target subscription
- Environment variables: AZURE_CLIENT_ID, AZURE_TENANT_ID, AZURE_CLIENT_SECRET, AZURE_SUBSCRIPTION_ID
Key Detection Areas
- Public blob access —
allow_blob_public_accessenabled on storage account or individual containers set to Blob/Container access level - HTTPS enforcement —
enable_https_traffic_onlydisabled, allowing unencrypted HTTP traffic - Minimum TLS version — accounts accepting TLS 1.0 or TLS 1.1 instead of minimum TLS 1.2
- Encryption at rest — storage service encryption not enabled or missing customer-managed keys
- Network rules — default action set to Allow instead of Deny, exposing storage to all networks
- SAS token risks — account-level SAS with overly broad permissions or excessive lifetime
Output
JSON report with per-account findings, severity ratings (Critical/High/Medium/Low), and remediation recommendations aligned with CIS Azure Benchmark controls.
Frequently asked questions about Detecting Azure Storage Account Misconfigurations
Similar skills
Data Breach Blast Radius Analyzer
Assess potential breach impacts before they occur.
Verify Agent Action
Ensure safe execution of AI agent actions with thorough reviews.
Agent Supply Chain Integrity
Ensure the integrity of AI agent plugins and tools.
Agent OWASP ASI Compliance Check
Ensure your AI agents meet OWASP ASI security standards.
Securing S3 Buckets
Enhance your S3 bucket security with AWS best practices.
AWS Account Enumeration with ScoutSuite
Assess AWS security posture with comprehensive audits.