Azure Storage Blob Access of Potential Executable Content
Detects 'GetBlob' operations on Azure Storage blobs that have extensions commonly associated with executable files, scripts, or archives, which may indicate the retrieval of malicious payloads.
Microsoft Sentinel (KQL)

