Series
Azure attack techniques, investigated
7 posts in this series. Read them in order or jump to any one.
- Azure role assignment abuse and elevateAccess, investigated
How attackers escalate with Azure role assignments and elevateAccess, what roleAssignments/write events look like in the Activity Log, and how to triage them.
- Azure Run Command attacks: investigating VM execution
How attackers use Azure VM Run Command and the Custom Script Extension, what the Activity Log records (and omits), and which on-VM artifacts hold the script.
- Key Vault audit logs: who read which secret, and when
Use Azure Key Vault audit logs (AuditEvent) to find who read which secret: SecretGet and SecretList, access policy changes, new principals and enumeration.
- Azure Storage data exfiltration: SAS tokens and blob logs
Investigate Azure Storage data exfiltration: listAccountSas and listKeys in the Activity Log, GetBlob bursts in blob logs, SAS token hashes, what to rotate.
- Azure defense evasion: deleted logs and disabled Defender
Deleted diagnostic settings, removed Activity Log export, Defender plans set to Free, locks and NSG rules: spotting Azure defense evasion, and what survives.
- NSG and VNet flow logs analysis for exfiltration
NSG and VNet flow logs analysis for incident response: tuple formats, bytes and flow states, spotting exfiltration, mining and attacker IPs, blind spots.
- Managed identity and service principal abuse in Azure
How attackers abuse Azure service principals and managed identities: leaked secrets, IMDS token theft, federated credentials, runbooks, and the log signals.