Detect Enumeration Activity Using Unique Identifiers and Session Aggregation

"This Kusto (KQL) hunting query detects blob-enumeration or file-spraying behaviour in Azure Storage by: - Aggregating requests into time-bound sessions with row_window_session(). - Defining a "user" as the combination of AccountName | UserAgentHeader, which is tolerant of rapid IP rotation. - Raising an alert when, within any single session: - The actor touches at least 10 distinct objects, and - At least 50 % of those requests return an HTTP 4xx/5xx status, and - Each object is accessed exactly once ("touch-once" pattern typical of enumeration). All tuning knobs (look-back window, session gap, thresholds, authentication type) are exposed at the top of the query. Be sure to validate the query against both benign and malicious samples in your own environment before relying on it for production detection. Reference: https://techcommunity.microsoft.com/blog/microsoftdefendercloudblog/protect-your-storage-resources-against-blob-hunting/3735238"