Posts tagged: #azure

Azure Activity Log retention is 90 days and resource logs are off by default. What each Azure log cannot tell you, and how to write an honest conclusion.

A fictional Azure breach investigated end to end: leaked app secret, self-assigned role, Run Command, stolen managed identity token, Key Vault and blob theft.

How attackers abuse Azure service principals and managed identities: leaked secrets, IMDS token theft, federated credentials, runbooks, and the log signals.

NSG and VNet flow logs analysis for incident response: tuple formats, bytes and flow states, spotting exfiltration, mining and attacker IPs, blind spots.

Deleted diagnostic settings, removed Activity Log export, Defender plans set to Free, locks and NSG rules: spotting Azure defense evasion, and what survives.

Investigate Azure Storage data exfiltration: listAccountSas and listKeys in the Activity Log, GetBlob bursts in blob logs, SAS token hashes, what to rotate.

Use Azure Key Vault audit logs (AuditEvent) to find who read which secret: SecretGet and SecretList, access policy changes, new principals and enumeration.

How attackers use Azure VM Run Command and the Custom Script Extension, what the Activity Log records (and omits), and which on-VM artifacts hold the script.

How attackers escalate with Azure role assignments and elevateAccess, what roleAssignments/write events look like in the Activity Log, and how to triage them.

Step-by-step Azure Activity Log analysis with the free Azure Forensics analyzer: load exports, read the verdict, findings, timeline and entities, export.

Export the Azure Activity Log, Key Vault, storage and flow logs for an investigation: portal, az CLI, Log Analytics and storage exports, and the traps.

Think your Azure subscription is compromised? Which logs to preserve first, the operations that betray an attacker, and how to go from Activity Log to verdict.