About

Imported from mukul975/anthropic-cybersecurity-skills (skills/detecting-azure-storage-account-misconfigurations/SKILL.md). Install upstream with npx skills add mukul975/anthropic-cybersecurity-skills --skill detecting-azure-storage-account-misconfigurations. Copyright stays with the author (Apache-2.0).

Detecting Azure Storage Account Misconfigurations

Name: detecting-azure-storage-account-misconfigurations
Author: mukul975

Overview

Azure Storage accounts are a frequent target for attackers due to misconfigured public access, long-lived SAS tokens, missing encryption, and outdated TLS versions. This skill uses the azure-mgmt-storage Python SDK with StorageManagementClient to enumerate all storage accounts in a subscription, inspect their security properties, list blob containers for public access settings, and generate a risk-scored audit report identifying critical misconfigurations.

When to Use

When investigating security incidents that require detecting azure storage account misconfigurations
When building detection rules or threat hunting queries for this domain
When SOC analysts need structured procedures for this analysis type
When validating security monitoring coverage for related attack techniques

Prerequisites

Python 3.9+ with azure-mgmt-storage, azure-identity
Azure service principal with Reader role on target subscription
Environment variables: AZURE_CLIENT_ID, AZURE_TENANT_ID, AZURE_CLIENT_SECRET, AZURE_SUBSCRIPTION_ID

Key Detection Areas

Public blob access — allow_blob_public_access enabled on storage account or individual containers set to Blob/Container access level
HTTPS enforcement — enable_https_traffic_only disabled, allowing unencrypted HTTP traffic
Minimum TLS version — accounts accepting TLS 1.0 or TLS 1.1 instead of minimum TLS 1.2
Encryption at rest — storage service encryption not enabled or missing customer-managed keys
Network rules — default action set to Allow instead of Deny, exposing storage to all networks
SAS token risks — account-level SAS with overly broad permissions or excessive lifetime

Output

JSON report with per-account findings, severity ratings (Critical/High/Medium/Low), and remediation recommendations aligned with CIS Azure Benchmark controls.

Use it

Copy one of these into your project. Installing also returns the manifest and these snippets.

yaml

targets:
  - https://api.opensmartroute.ai/api/v1/registry/mukul975-anthropic-cybersecurity-skills-detecting-azure-0548ce/manifest   # or paste the manifest below

Manifest

An Open Capability Manifest: the router reads it to know what this does, what it costs and when to pick it.

mukul975-anthropic-cybersecurity-skills-detecting-azure-0548ce.ocm.jsonjson

{
  "ocm": "1",
  "id": "mukul975-anthropic-cybersecurity-skills-detecting-azure-0548ce",
  "kind": "skill",
  "name": "detecting-azure-storage-account-misconfigurations",
  "description": "Audit Azure Blob and ADLS storage accounts for public access exposure, weak or long-lived SAS tokens, missing encryption at rest, disabled HTTPS-only traffic, and outdated TLS versions, using the azure-mgmt-storage Python SDK to generate a risk-scored report. Use when assessing an Azure subscription's storage accounts for misconfiguration, building cloud security posture checks, or investigating a suspected data exposure via public blob access.",
  "publisher": "mukul975",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "coding",
      "customer_support"
    ],
    "tags": [
      "skill-md",
      "azure",
      "storage-accounts",
      "blob-storage",
      "adls",
      "sas-tokens",
      "encryption",
      "public-access",
      "cloud-misconfiguration",
      "azure-mgmt-storage"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "Audit Azure Blob and ADLS storage accounts for public access exposure, weak or long-lived SAS tokens, missing encryption at rest, disabled HTTPS-only traffic, and outdated TLS versions, using the azure-mgmt-storage Python SDK to generate a risk-scored report. Use when assessing an Azure subscription's storage accounts for misconfiguration, building cloud security posture checks, or investigating a suspected data exposure via public blob access."
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "skills.sh",
      "repository": "https://github.com/mukul975/anthropic-cybersecurity-skills",
      "path": "skills/detecting-azure-storage-account-misconfigurations/SKILL.md",
      "ref": "HEAD",
      "url": "https://github.com/mukul975/anthropic-cybersecurity-skills/blob/HEAD/skills/detecting-azure-storage-account-misconfigurations/SKILL.md",
      "key": "mukul975/anthropic-cybersecurity-skills/skills/detecting-azure-storage-account-misconfigurations/SKILL.md"
    },
    "license": "Apache-2.0"
  },
  "instructions": "# Detecting Azure Storage Account Misconfigurations\n\n## Overview\n\nAzure Storage accounts are a frequent target for attackers due to misconfigured public access, long-lived SAS tokens, missing encryption, and outdated TLS versions. This skill uses the azure-mgmt-storage Python SDK with StorageManagementClient to enumerate all storage accounts in a subscription, inspect their security properties, list blob containers for public access settings, and generate a risk-scored audit report identifying critical misconfigurations.\n\n\n## When to Use\n\n- When investigating security incidents that require de",
  "cost": {
    "context_tokens": 485
  }
}

Fetch it by URL: GET /api/v1/registry/mukul975-anthropic-cybersecurity-skills-detecting-azure-0548ce/manifest?version=1.0.0

Reviews

Star ratings from people who tried it. One review per account; edit yours any time.

No reviews yet. Install it, try it, and be the first to rate it.