Azure Service Bus Shared Access Signature
Detects Azure Service Bus Shared Access Signature (SAS) token patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Engine
- universal
- Confidence
- high
- Confidence justification
- High confidence: SharedAccessSignature prefix combined with sr, sig, se, and skn parameters is structurally unique to Azure Service Bus SAS tokens. Added context gating and exclusion rules improve precision and reduce incidental matches.
- Detection quality
- Partial
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
- Data categories
- credentials, security
- Scope
- specific
- Risk rating
- 10
- Platform compatibility
- Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported
Pattern
(?i)SharedAccessSignature\s+sr=[^&]+&sig=[A-Za-z0-9%+/=]+&se=\d+&skn=[A-Za-z0-9_]+Corroborative evidence keywords
Service Bus, SharedAccessSignature, SAS token, sr=, sig=, skn=, authorization, namespace, api key, api_key, apikey, access key, access token, auth token, bearer, conn str, connection string, connectionstring, cookie, credential (+44 more)
Proximity: 300 characters
Should match
SharedAccessSignature sr=https%3a%2f%2fmynamespace.servicebus.windows.net&sig=AAAA0000%3d&se=1735689600&skn=RootManageSharedAccessKey— Service Bus SAS tokenSharedAccessSignature sr=sb%3a%2f%2ftest-ns.servicebus.windows.net&sig=000000000%3d&se=9999999999&skn=sendpolicy— Service Bus SAS for send policySharedAccessSignature sr=mynamespace&sig=ABCDEFghijkl%2B%3D&se=1700000000&skn=listen— Service Bus SAS for listen policy
Should not match
SharedAccessSignature sr=myresource— Incomplete SAS token without sigAuthorization=Bearer eyJhbGciOiJIUzI1NiJ9— Bearer token, not SAStemplate example placeholder record identifier— Template/sample context should be excluded even when anchor words are present
Known false positives
- Service Bus documentation with example SAS tokens. Mitigation: Check for common placeholder values in the sig parameter.
- Expired SAS tokens that no longer grant access. Mitigation: Check se= (expiry) parameter but flag regardless since the token reveals infrastructure details.