👩‍💻 AHHHZURE

AHHHZURE is an automated deployment noscript that creates a vulnerable Azure cloud lab for offensive security practitioners and enthusiasts to brush up their cloud sec skills.

https://github.com/gladstomych/AHHHZURE

#azure

👩‍💻 New Microsoft Incident Response guide helps simplify cyberthreat investigations

Microsoft Incident Response experts have created a guide on using Windows Internals for forensic investigations.

https://www.microsoft.com/en-us/security/blog/2024/04/23/new-microsoft-incident-response-guide-helps-simplify-cyberthreat-investigations/

#azure

👩‍💻 You Can't See Me: Achieving Stealthy Persistence in Azure Machine Learning

When an AML workspace is created, by default, the Storage Account is publicly accessible using the access key.

https://www.trendmicro.com/vinfo/in/security/news/cybercrime-and-digital-threats/you-cant-see-me-achieving-stealthy-persistence-in-azure-machine-learning

#azure

👩‍💻 A Look at a Recently Patched Microsoft Graph Logging Bypass - GraphNinja

From June 2023 to March 2024, Microsoft Graph was vulnerable to a logging bypass that allowed attackers to perform password-spray attacks undetected. During this period, any organization in Azure could have been attacked and would have had no indication of the activity.

https://trustedsec.com/blog/full-disclosure-a-look-at-a-recently-patched-microsoft-graph-logging-bypass-graphninja

#azure

👩‍💻 Arbitrary 1-click Azure tenant takeover via MS application

This blog explains how reply URLs in Azure Applications can be used as a vector for phishing. The impact of this can range from data leaks to complete tenant takeover; just by luring a victim into clicking on a link.

https://falconforce.nl/arbitrary-1-click-azure-tenant-takeover-via-ms-application/

#azure

👩‍💻 Hunting in Azure subnoscriptions

This blog post covers various strategies and methodologies to help understand the scope and complexity of how threat actors' manoeuvre within Azure subnoscriptions.

https://techcommunity.microsoft.com/t5/microsoft-security-experts-blog/hunting-in-azure-subnoscriptions/ba-p/4125875

#azure

🔶👩‍💻 Unmasking Adversary Cloud Defense Evasion Strategies: Modify Cloud Compute Infrastructure Part 2

To prevent abuse against the use of Snapshot Creation, Instance Creation and Instance Deletion features within cloud environments, security teams and cyber-defenders must ensure that proper monitoring and logging services are enabled across all cloud providers they utilize.

https://permiso.io/blog/unmasking-adversary-cloud-defense-evasion-strategies-modify-cloud-compute-infrastructure-part-2-detections-and-mitigations

#aws #azure