Blog Post

Microsoft Defender for Cloud Blog

2 MIN READ

Validating Microsoft Defender for Storage Detections

Microsoft

Dec 16, 2019

Microsoft Defender for Storage provides an additional layer of security intelligence that can be used to detect unusual and potentially harmful attempts to access or exploit storage accounts. This fe...

Updated Oct 28, 2021

Version 5.0

YuriDiogenes

Microsoft

Joined March 01, 2018

View Profile

Microsoft Defender for Cloud Blog

Microsoft Defender for Cloud is a cloud-native application platform (CNAPP) that offers security and compliance from code to runtime, enhanced by AI, for hybrid and multicloud environments.

maloym

Copper Contributor

Apr 20, 2022

YuriDiogenes - does Defender for storage inspect zip files for malware whether executables / other ransomware or even Eicar signatures ?

In particular, is either of the following alerts triggered when the .exe is hidden in a .zip file or embedded in a file with different extension e.g. .doc(x)/.xls(x) etc. ?

1. "Unusual upload of .exe to a storage account (Storage.Blob_ExeUploadAnomaly Storage.Files_ExeUploadAnomaly)"

2. Potential malware uploaded to a storage account (Storage.Blob_MalwareHashReputation Storage.Files_MalwareHashReputation)

I know hash reputation analysis has its limitations, but having a clear set of exclusions allow clients to build a proper defense solution and improve security posture.