Skip to content
Azure Forensics

This tool is not affiliated with, endorsed by or sponsored by Microsoft Corporation. Azure, Microsoft Azure and Microsoft Defender for Cloud are trademarks of the Microsoft group of companies. Other names are trademarks of their respective owners.

Posts tagged: #mitre-attack

← Back to all posts
Managed identity and service principal abuse in Azure
How attackers abuse Azure service principals and managed identities: leaked secrets, IMDS token theft, federated credentials, runbooks, and the log signals.
azureidentityactivity-logmitre-attack
NSG and VNet flow logs analysis for exfiltration
NSG and VNet flow logs analysis for incident response: tuple formats, bytes and flow states, spotting exfiltration, mining and attacker IPs, blind spots.
azureflow-logsexfiltrationmitre-attack
Azure defense evasion: deleted logs and disabled Defender
Deleted diagnostic settings, removed Activity Log export, Defender plans set to Free, locks and NSG rules: spotting Azure defense evasion, and what survives.
azuredefense-evasionloggingmitre-attack
Azure Storage data exfiltration: SAS tokens and blob logs
Investigate Azure Storage data exfiltration: listAccountSas and listKeys in the Activity Log, GetBlob bursts in blob logs, SAS token hashes, what to rotate.
azurestorageexfiltrationmitre-attack
Key Vault audit logs: who read which secret, and when
Use Azure Key Vault audit logs (AuditEvent) to find who read which secret: SecretGet and SecretList, access policy changes, new principals and enumeration.
azurekey-vaultincident-responsemitre-attack
Azure Run Command attacks: investigating VM execution
How attackers use Azure VM Run Command and the Custom Script Extension, what the Activity Log records (and omits), and which on-VM artifacts hold the script.
azurevirtual-machinesactivity-logmitre-attack
Azure role assignment abuse and elevateAccess, investigated
How attackers escalate with Azure role assignments and elevateAccess, what roleAssignments/write events look like in the Activity Log, and how to triage them.
azurerbacactivity-logmitre-attack
Azure subscription compromised? An incident response guide
Think your Azure subscription is compromised? Which logs to preserve first, the operations that betray an attacker, and how to go from Activity Log to verdict.
azureincident-responseactivity-logmitre-attack

This tool is not affiliated with, endorsed by or sponsored by Microsoft Corporation. Azure, Microsoft Azure and Microsoft Defender for Cloud are trademarks of the Microsoft group of companies. Other names are trademarks of their respective owners.