This rule detects the first occurrence of anonymous (unauthenticated) data-plane read access to an Azure Storage resource, focusing on GetBlob and related operations (e.g., GetBlobMetadata, GetBlockList, ListBlobs, GetContainerProperties, etc.). Anonymous requests indicate probes of public containers or testing stolen blob URLs prior to applying a SAS token. The rule marks the first-seen resource via azure.resource.id to constrain noise while still covering WireServer-related probes of status or extension blobs. It relies on StorageRead diagnostic logs from Azure Platform Logs and notes that source.ip is often empty, advising the use of source.address. Investigation should verify event.action, statusCode, and uri; a 200 with Anonymous implies public readability, while 403/409 suggests probing. Correlate with SAS-authenticated reads to the same account shortly after. Look for indicators such as $system/ or md-hdd- in the URI as potential WireServer activity on VMs. False positives include intentionally public blob websites or CDNs, or new accounts that enable StorageRead for the first time. Remediation involves disabling anonymous public access on private accounts, revoking any SAS, and continuing to collect StorageRead logs for monitoring. This rule maps to MITRE techniques: Cloud Infrastructure Discovery (T1580) and Data from Cloud Storage (T1530).