Lab: Defender for Storage Malware Scanning and Sentinel

Deploy malware scanning for uploaded blobs and correlate post-verdict reads in Sentinel with Bicep, analytics rules, a workbook, and safe simulations.

Overview

This lab enables Defender for Storage malware scanning, routes the resulting security evidence into Sentinel, and validates detection and investigation paths with deliberately bounded test scenarios.

Start Here

  1. Read the companion article for the evidence model and tested detection behavior.
  2. Use the canonical GitHub repository for prerequisites, deployment, validation, troubleshooting, and cleanup.
  3. Run only the documented safe simulations in an isolated lab subscription.

Never upload real malware. The lab uses safe test artifacts and defensive validation paths.

Rule 5 Validation Boundary

The included scripts do not automate Rule 5. Azure can reject completely unauthenticated garbage before it reaches StorageBlobLogs; a few bad SAS strings are therefore not a reliable test. Reproduce the correlation only with a disposable, authenticated but under-privileged principal that generates authorization failures, followed by successful reads from the same egress IP. Remove that identity afterward.

Historical companion-article evidence records a successful live Rule 5 incident created with this controlled method. That evidence does not turn the public attack scripts into a deterministic Rule 5 generator.