Azure Forensics — Blog https://www.azureforensics.app/en/blog Latest from Blog en Sun, 27 Sep 2026 20:41:46 GMT Azure log forensics limits: retention and missing logs https://www.azureforensics.app/en/blog/azure-log-forensics-limitations https://www.azureforensics.app/en/blog/azure-log-forensics-limitations Azure Activity Log retention is 90 days and resource logs are off by default. What each Azure log cannot tell you, and how to write an honest conclusion. Florian Amette Sun, 27 Sep 2026 00:00:00 GMT An Azure breach, walked through (fictional case) https://www.azureforensics.app/en/blog/azure-breach-walkthrough-fictional https://www.azureforensics.app/en/blog/azure-breach-walkthrough-fictional A fictional Azure breach investigated end to end: leaked app secret, self-assigned role, Run Command, stolen managed identity token, Key Vault and blob theft. Florian Amette Thu, 24 Sep 2026 00:00:00 GMT Managed identity and service principal abuse in Azure https://www.azureforensics.app/en/blog/azure-managed-identity-app-registration-abuse https://www.azureforensics.app/en/blog/azure-managed-identity-app-registration-abuse How attackers abuse Azure service principals and managed identities: leaked secrets, IMDS token theft, federated credentials, runbooks, and the log signals. Florian Amette Tue, 22 Sep 2026 00:00:00 GMT NSG and VNet flow logs analysis for exfiltration https://www.azureforensics.app/en/blog/nsg-vnet-flow-logs-exfiltration https://www.azureforensics.app/en/blog/nsg-vnet-flow-logs-exfiltration NSG and VNet flow logs analysis for incident response: tuple formats, bytes and flow states, spotting exfiltration, mining and attacker IPs, blind spots. Florian Amette Sat, 19 Sep 2026 00:00:00 GMT Azure defense evasion: deleted logs and disabled Defender https://www.azureforensics.app/en/blog/azure-defense-evasion-diagnostic-settings https://www.azureforensics.app/en/blog/azure-defense-evasion-diagnostic-settings Deleted diagnostic settings, removed Activity Log export, Defender plans set to Free, locks and NSG rules: spotting Azure defense evasion, and what survives. Florian Amette Thu, 17 Sep 2026 00:00:00 GMT Azure Storage data exfiltration: SAS tokens and blob logs https://www.azureforensics.app/en/blog/azure-storage-sas-data-exfiltration https://www.azureforensics.app/en/blog/azure-storage-sas-data-exfiltration Investigate Azure Storage data exfiltration: listAccountSas and listKeys in the Activity Log, GetBlob bursts in blob logs, SAS token hashes, what to rotate. Florian Amette Tue, 15 Sep 2026 00:00:00 GMT Key Vault audit logs: who read which secret, and when https://www.azureforensics.app/en/blog/key-vault-audit-logs-secret-access https://www.azureforensics.app/en/blog/key-vault-audit-logs-secret-access Use Azure Key Vault audit logs (AuditEvent) to find who read which secret: SecretGet and SecretList, access policy changes, new principals and enumeration. Florian Amette Sat, 12 Sep 2026 00:00:00 GMT Azure Run Command attacks: investigating VM execution https://www.azureforensics.app/en/blog/azure-run-command-attack https://www.azureforensics.app/en/blog/azure-run-command-attack How attackers use Azure VM Run Command and the Custom Script Extension, what the Activity Log records (and omits), and which on-VM artifacts hold the script. Florian Amette Thu, 10 Sep 2026 00:00:00 GMT Azure role assignment abuse and elevateAccess, investigated https://www.azureforensics.app/en/blog/azure-role-assignment-abuse-elevate-access https://www.azureforensics.app/en/blog/azure-role-assignment-abuse-elevate-access How attackers escalate with Azure role assignments and elevateAccess, what roleAssignments/write events look like in the Activity Log, and how to triage them. Florian Amette Tue, 08 Sep 2026 00:00:00 GMT Azure Activity Log analysis, step by step, in your browser https://www.azureforensics.app/en/blog/analyze-azure-logs-with-azure-forensics https://www.azureforensics.app/en/blog/analyze-azure-logs-with-azure-forensics Step-by-step Azure Activity Log analysis with the free Azure Forensics analyzer: load exports, read the verdict, findings, timeline and entities, export. Florian Amette Sat, 05 Sep 2026 00:00:00 GMT How to export the Azure Activity Log and resource logs https://www.azureforensics.app/en/blog/export-azure-activity-log-resource-logs https://www.azureforensics.app/en/blog/export-azure-activity-log-resource-logs Export the Azure Activity Log, Key Vault, storage and flow logs for an investigation: portal, az CLI, Log Analytics and storage exports, and the traps. Florian Amette Thu, 03 Sep 2026 00:00:00 GMT Azure subscription compromised? An incident response guide https://www.azureforensics.app/en/blog/azure-incident-response-compromised-subscription https://www.azureforensics.app/en/blog/azure-incident-response-compromised-subscription Think your Azure subscription is compromised? Which logs to preserve first, the operations that betray an attacker, and how to go from Activity Log to verdict. Florian Amette Tue, 01 Sep 2026 00:00:00 GMT