We are storing around 30TB of data in azure storage blob.what options do we have to detect that ransom ware attack has happened and how can we save the remaining data. I am looking options other than azure immutable option with azure storage . How to get alerts for suspicious activity or ransom ware attack on azure storage ?

@MS Techie Thanks for reaching out to Microsoft Q&A. I understand that you want to know options to detect ransomware attacks activity and how you can prevent them, is that right? Microsoft Defender for Storage is an Azure-native layer of security intelligence that detects unusual and potentially harmful attempts to access or exploit your storage accounts. It uses advanced threat detection capabilities and Microsoft Threat Intelligence data to provide contextual security alerts. Those alerts also include steps to mitigate the detected threats and prevent future attacks. Please refer to this document for details information regarding this and how to enable this for your storage account- [https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-storage-introduction Is this helpful, or do you need further assistance? Please let me know. Thank you! Remember: Please accept an answer if correct. Original posters help the community find answers faster by identifying the correct answer. Here is how . Want a reminder to come back and check responses? Here is how to subscribe to a notification.

Virus/ramsomware detection on azure storage

Accepted answer

SaiKishor-MSFT 17,321 Reputation points

2023-01-13T22:52:49.59+00:00

@MS Techie Thanks for reaching out to Microsoft Q&A. I understand that you want to know options to detect ransomware attacks activity and how you can prevent them, is that right?

Microsoft Defender for Storage is an Azure-native layer of security intelligence that detects unusual and potentially harmful attempts to access or exploit your storage accounts. It uses advanced threat detection capabilities and Microsoft Threat Intelligence data to provide contextual security alerts. Those alerts also include steps to mitigate the detected threats and prevent future attacks.

Please refer to this document for details information regarding this and how to enable this for your storage account- [https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-storage-introduction

Is this helpful, or do you need further assistance? Please let me know. Thank you!

Remember:

Please accept an answer if correct. Original posters help the community find answers faster by identifying the correct answer. Here is how.

Want a reminder to come back and check responses? Here is how to subscribe to a notification.
Please sign in to rate this answer.
MS Techie 2,716 Reputation points

2023-01-16T16:26:09.2666667+00:00

if there is any ransomware attack on the azure storage account , then will it intimate us ?

If Yes, can you share a sample email generated by Defender for storage indicating ransomware attack on storage ?

SaiKishor-MSFT 17,321 Reputation points

2023-01-17T07:11:59.4233333+00:00

@MS Techie I generated a sample alert for ransomware as seen below on Microsoft Defender for Cloud Portal-

THIS IS A SAMPLE ALERT: Analysis of host data on OMS-AGENT-2 detected indicators associated with Petya ransomware. See https://blogs.technet.microsoft.com/mmpc/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/ for more information. Review the command line associated in this alert and escalate this alert to your security team.

Mitigate the threat

Run a full anti-malware scan and verify that the threat was removed

Install and run Microsoft’s Malicious Software Removal Tool (see http://www.microsoft.com/security/pc-security/malware-removal.aspx)

Perform these actions pre-emptively on other hosts in your network.

Prevent future attacks

Solving security recommendations can prevent future attacks by reducing attack surface.

It also has more details such as time and priority of attack and effected resources etc., If you setup email forwarding to your email address, this will also be forwarded accordingly. Does this help?

Please let me know. Thank you!

Remember:

Please accept an answer if correct. Original posters help the community find answers faster by identifying the correct answer. Here is [how][1].

Want a reminder to come back and check responses? Here is [how][2] to subscribe to a notification.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Virus/ramsomware detection on azure storage

0 additional answers

Your answer