Mapping Azure Security Threats: A MITRE ATT&CK Mind Map
The MITRE ATT&CK framework in Azure environments is pivotal for searching, detecting, investigating, and mitigating attacks. This cheat critically maps MITRE ATT&CK tactics to Azure services, enabling proactive threat hunting and precise incident response.
🛡️Key Insights:
⇨ Initial Access: Attackers may gain entry via Azure CLI or compromised web apps. SignInLogs and AADServicePrincipalSignInLogs are essential for identifying suspicious login events.
⇨ Execution: Attackers often exploit Automation Accounts and VM scripts to run malicious code. Monitoring for abnormal execution of operations like MicrosoftCompute/virtualMachines/runCommand/action is crucial.
⇨ Privilege Escalation: Changes to Entra ID users, groups, or roles (via operations like Microsoftdirectory/servicePrincipals/enable) should be closely monitored for abnormal permission escalations.
⇨ Credential Access: Focus on Azure Key Vault activity. Unauthorized access or changes to secrets, certificates, and keyscould indicate credential harvesting.
⇨ Exfiltration: Attackers often use SAS URIs or soft delete data to move data undetected. Investigate suspicious API calls like MicrosoftStorage/storageAccounts/listAccountSas/action.
By integrating the MITRE ATT&CK framework with Azure specific actions, you can uncover potential attack paths, identify risks, and map adversary behaviors to real time activities across Azure services.
🛡️ Tip: Always trace back suspicious activities to their root cause. Correlate logs, activity details, and authentication anomalies to identify early signs of compromise and pivoting.
Many thanks, Expel, for a great mind map.
Comments
Post a Comment