Azure Security Assessment Checklist

🔍 Reconnaissance & Enumeration

Initial Discovery

  • Identify Azure tenant (login.microsoftonline.com)
  • Enumerate Azure AD users (o365creeper)
  • Check for open blob storage
  • Subdomain enumeration for Azure services
  • Identify exposed Azure APIs
  • Check for Azure DevOps instances
  • App Registration

AADInternals Enumeration

# Install module
Install-Module AADInternals


Get tenant info

Get-AADIntLoginInformation -UserName user@target.com
Get-AADIntTenantDomains -Domain target.com

Azure CLI Reconnaissance

# Login
az login


Get subscription info

az account list --output table


List resource groups

az group list --output table


List all resources

az resource list --output table

👤 Azure AD Assessment

User & Group Enumeration

  • Enumerate all users
  • Identify privileged users (Global Admin, etc.)
  • List all groups and memberships
  • Check for guest users
  • Identify service principals
  • Review app registrations

AzureHound Collection

# Invoke AzureHound
Import-Module Az
Import-Module AzureADPreview
Connect-AzureAD


Collect data for BloodHound

Invoke-AzureHound

Conditional Access

  • Review conditional access policies
  • Identify policy gaps
  • Test MFA enforcement
  • Check for legacy auth enabled
  • Verify device compliance policies

🔐 Authentication & Identity

Password Security

  • Test password spray attacks
  • Check for password hash sync
  • Review self-service password reset
  • Test for weak passwords
  • Check banned password list

Token Abuse

  • Extract access tokens
  • Test token replay
  • Check refresh token validity
  • Test for token leakage
  • JWT manipulation testing
# Get access token
$token = (Get-AzAccessToken).Token


Use token with REST API

$headers = @{Authorization = "Bearer $token"}
Invoke-RestMethod -Uri "https://graph.microsoft.com/v1.0/me" -Headers $headers

☁️ Azure Resources Assessment

Storage Accounts

  • Check for public blob access
  • Enumerate containers
  • Test SAS token permissions
  • Check for anonymous access
  • Review access policies
  • Test for misconfigured CORS
# List public blobs
az storage blob list --account-name TARGET --container-name CONTAINER --output table


Anonymous access check

curl https://TARGET.blob.core.windows.net/CONTAINER/FILE

Key Vault

  • Enumerate key vaults
  • Check access policies
  • List secrets and keys
  • Test for over-permissive access
  • Review soft-delete settings
# List key vaults
az keyvault list --output table


List secrets

az keyvault secret list --vault-name VAULT_NAME

Virtual Machines

  • Enumerate all VMs
  • Check for public IPs
  • Review NSG rules
  • Test for exposed management ports
  • Check disk encryption
  • Review extension configurations
  • Test Managed Identity abuse

SQL Databases

  • Check for public endpoints
  • Test firewall rules
  • Review Azure AD integration
  • Check for TDE encryption
  • Test for SQL injection

🔄 Managed Identities

System-Assigned Identity

# From compromised VM, get token
curl 'http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/' -H Metadata:true

User-Assigned Identity

  • Identify user-assigned identities
  • Check assigned permissions
  • Test for privilege escalation
  • Review cross-resource access

IMDS Exploitation

  • Access Instance Metadata Service
  • Extract tokens from IMDS
  • Test token permissions
  • Pivot using obtained tokens

⚙️ Azure DevOps Security

Pipeline Security

  • Check for exposed repos
  • Review pipeline configurations
  • Test for secrets in pipelines
  • Check variable group permissions
  • Review service connections

Repository Access

  • Enumerate repositories
  • Check branch policies
  • Test for sensitive data in code
  • Review commit history
  • Check for leaked credentials

📊 Privilege Escalation Paths

Common Paths

Vector Risk Impact
Managed Identity abuse High Resource access
Storage key exposure High Data access
App registration secrets High API access
Contributor to Owner Critical Full control
VM command execution High Code execution
Automation runbook abuse High Privilege escalation

Azure Role Abuse

  • Check for custom roles
  • Identify over-permissive roles
  • Test for role assignment capability
  • Check management group inheritance

🛡️ Security Configurations

Network Security

  • Review NSG rules
  • Check for open management ports (3389, 22, 5985)
  • Verify service endpoints
  • Test private endpoints
  • Review VNet peering
  • Check for Azure Firewall

Logging & Monitoring

  • Verify Azure Activity Log
  • Check diagnostic settings
  • Review Azure Monitor alerts
  • Test for log gaps
  • Verify Microsoft Defender status

🛠️ Essential Tools

Tool Purpose
AzureHound Azure AD attack paths
AADInternals Azure AD recon
MicroBurst Azure pentesting
ROADtools Azure AD analysis
Azure CLI Azure management
PowerZure Azure exploitation
ScoutSuite Cloud security audit

Installation

# Azure CLI
curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash


AADInternals

Install-Module AADInternals


MicroBurst

git clone https://github.com/NetSPI/MicroBurst
Import-Module .\MicroBurst.psm1

📋 Quick Commands Reference

# Enumerate users
az ad user list --output table


Get current user permissions

az role assignment list --assignee $(az ad signed-in-user show --query id -o tsv)


List all storage accounts

az storage account list --query "[].{name:name,location:location}" -o table


Check VM managed identity

az vm identity show --resource-group RG --name VM


Get Key Vault secrets

az keyvault secret list --vault-name VAULT --output table
Last updated: 2024