• CommunityEnterprisePlans
  • Intel Exchange
    Intel ExchangeDetections
  • Resources
  • About
  • Leaderboard
Join CommunitySign In
    All Detections

    Azure Storage file upload from VPS Providers

    GlassDiceBearhttps://www.dicebear.comhttps://creativecommons.org/publicdomain/zero/1.0/„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
    Azure Sentinel@AzureSentinel
    •updated Jun 17, 2025•8•0•63

    'Looks for file uploads actions to Azure File and Blob Storage from known VPS provider network ranges. This is not an exhaustive list of VPS provider ranges but covers some of the most prevalent providers observed.'

    Microsoft Sentinel (KQL)

    Tags

    T1570 - Lateral Tool TransferTA0008 - Lateral MovementT1608.002 - Upload ToolT1608.001 - Upload MalwareT1567.002 - Exfiltration to Cloud StorageTA0042 - Resource DevelopmentTA0010 - ExfiltrationT1027.011 - Fileless StorageDS0010 - Cloud StorageDS0034 - VolumeT1583.003 - Virtual Private ServerT1584.003 - Virtual Private ServerC0053 - FLORAHOX ActivityTA0005 - Defense EvasionFile UploadNetwork ConnectionCloud Storage AccessAzureAzure Monitor LogskqlIgnite2021tactic:LateralMovementtechnique:T1570

    Community Inspired.
    AI Enhanced.
    Better Detections.

    Follow Us

    Company

    • About
    • Leaderboard

    Product

    • Community
    • Enterprise
    • Plans

    © 2026 Copyright. All Rights Reserved.

    Privacy PolicyTerms of Service

    Sign up to view this detection

    or

    Already have an account?