Microsoft.Storage/storageAccounts/regenerateKey/action
Azure
Microsoft.Storage/storageAccounts/regenerateKey/action
Event
Regenerates one of the two access keys for an Azure Storage account, invalidating the previous key.
Security Context
- Regenerating storage account keys immediately invalidates the previous key, breaking all applications and services that were using it for authentication while granting the attacker the new key.
- This technique serves a dual purpose: the adversary obtains valid credentials to access storage data while simultaneously disrupting legitimate access, combining credential theft with operational impact.
Log Source
Azure Activity Log
Sample Event
Adversarial. draco@fantasticlogs.cloud regenerates key1 on the production storage account flcoccamy001. Dual-purpose: (1) Draco gets a brand-new valid key in his hands, and (2) every legitimate application using key1 (the OCCAMY ingestion pipeline) immediately breaks until it picks up the new key. Maps cleanly to T1528 (Steal Application Access Token) + T1531 (Account Access Removal).
{ "authorization": { "action": "Microsoft.Storage/storageAccounts/regenerateKey/action", "scope": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-occamy-pipeline/providers/Microsoft.Storage/storageAccounts/flcoccamy001" }, "caller": "draco@fantasticlogs.cloud", "channels": "Operation", "claims": { "appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46", "ipaddr": "203.0.113.66", "name": "Draco Malfoy", "http://schemas.microsoft.com/identity/claims/objectidentifier": "30000000-0000-4000-8000-001010011010", "puid": "1003200000000666", "http://schemas.microsoft.com/identity/claims/tenantid": "10000000-0000-4000-8000-000000000001", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "draco@fantasticlogs.cloud", "http://schemas.microsoft.com/identity/claims/wids": "e8611ab8-c189-46e8-94e1-60213ab1f814", "uti": "saRk225ExampleUtid01", "ver": "1.0" }, "correlationId": "90000000-0000-4000-8000-000100010111", "description": "", "eventDataId": "90000000-0000-4000-8000-000100011000", "eventName": { "value": "EndRequest", "localizedValue": "End request" }, "category": { "value": "Administrative", "localizedValue": "Administrative" }, "eventTimestamp": "2026-04-15T17:59:18.5028207Z", "id": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-occamy-pipeline/providers/Microsoft.Storage/storageAccounts/flcoccamy001/events/90000000-0000-4000-8000-000100011000/ticks/638798225585028207", "level": "Informational", "operationId": "90000000-0000-4000-8000-000100111001", "operationName": { "value": "Microsoft.Storage/storageAccounts/regenerateKey/action", "localizedValue": "Regenerate Storage Account Keys" }, "resourceGroupName": "rg-occamy-pipeline", "resourceProviderName": { "value": "Microsoft.Storage", "localizedValue": "Microsoft.Storage" }, "resourceType": { "value": "Microsoft.Storage/storageAccounts", "localizedValue": "Microsoft.Storage/storageAccounts" }, "resourceId": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-occamy-pipeline/providers/Microsoft.Storage/storageAccounts/flcoccamy001", "status": { "value": "Succeeded", "localizedValue": "Succeeded" }, "subStatus": { "value": "OK", "localizedValue": "OK (HTTP Status Code: 200)" }, "submissionTimestamp": "2026-04-15T17:59:19.0421112Z", "subscriptionId": "20000000-0000-4000-8000-000000000001", "tenantId": "10000000-0000-4000-8000-000000000001", "properties": { "statusCode": "OK", "serviceRequestId": null, "eventCategory": "Administrative", "entity": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-occamy-pipeline/providers/Microsoft.Storage/storageAccounts/flcoccamy001/regenerateKey", "message": "Microsoft.Storage/storageAccounts/regenerateKey/action", "hierarchy": "10000000-0000-4000-8000-000000000001/20000000-0000-4000-8000-000000000001", "requestbody": "{\"keyName\":\"key1\"}" }, "relatedEvents": []}MITRE ATT&CK Mapping
Tactics: Credential Access Impact
Techniques:
- T1552 — Unsecured Credentials — Adversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. [Shell History](https://attack.mitre.org/techniques/T1552/003)), operating system or applica...
- T1531 — Account Access Removal — Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users. Accounts may be deleted, locked, or manipulated (ex: changed credentials, revoked permissions for SaaS platforms such as Sharepoint) to remove access to accounts....