Azure Storage File Create, Access, Delete
'This hunting query will identify where a file is uploaded to Azure File or Blob storage and is then accessed once before being deleted. This activity may be indicative of exfiltration activity.'
Microsoft Sentinel (KQL)
