👩‍💻 An Adversary Adventure with Cloud Administration Command

Permiso started a series of blog posts that will walk through some of MITRE's ATT&CK Matrix, diving deep into cloud-based techniques. The first post of this series covers Cloud Administration Command.

https://permiso.io/blog/an-adversary-adventure-with-cloud-administration-command

#azure

👩‍💻 New Microsoft guidance for the DoD Zero Trust Strategy

A Zero Trust activity-level guidance for DoD Components and DIB partners implementing the DoD Zero Trust Strategy.

https://www.microsoft.com/en-us/security/blog/2024/04/16/new-microsoft-guidance-for-the-dod-zero-trust-strategy/

#azure

👩‍💻 AHHHZURE

AHHHZURE is an automated deployment noscript that creates a vulnerable Azure cloud lab for offensive security practitioners and enthusiasts to brush up their cloud sec skills.

https://github.com/gladstomych/AHHHZURE

#azure

👩‍💻 New Microsoft Incident Response guide helps simplify cyberthreat investigations

Microsoft Incident Response experts have created a guide on using Windows Internals for forensic investigations.

https://www.microsoft.com/en-us/security/blog/2024/04/23/new-microsoft-incident-response-guide-helps-simplify-cyberthreat-investigations/

#azure

👩‍💻 You Can't See Me: Achieving Stealthy Persistence in Azure Machine Learning

When an AML workspace is created, by default, the Storage Account is publicly accessible using the access key.

https://www.trendmicro.com/vinfo/in/security/news/cybercrime-and-digital-threats/you-cant-see-me-achieving-stealthy-persistence-in-azure-machine-learning

#azure

👩‍💻 A Look at a Recently Patched Microsoft Graph Logging Bypass - GraphNinja

From June 2023 to March 2024, Microsoft Graph was vulnerable to a logging bypass that allowed attackers to perform password-spray attacks undetected. During this period, any organization in Azure could have been attacked and would have had no indication of the activity.

https://trustedsec.com/blog/full-disclosure-a-look-at-a-recently-patched-microsoft-graph-logging-bypass-graphninja

#azure

👩‍💻 Arbitrary 1-click Azure tenant takeover via MS application

This blog explains how reply URLs in Azure Applications can be used as a vector for phishing. The impact of this can range from data leaks to complete tenant takeover; just by luring a victim into clicking on a link.

https://falconforce.nl/arbitrary-1-click-azure-tenant-takeover-via-ms-application/

#azure