Pivoting with Azure Automation Account Connections

Karl Fosaaen starts an Azure Automation series, showing how runbook permissions allow attackers to export RunAs certificates and credentials for maintaining privileged access to Azure subscriptions.

Explores hosting red team phishing pages and payloads on Azure services under Microsoft's trusted domains, using their good reputation to slip past web filters as domain fronting fades.

Shows how Azure VM managed identities with excessive permissions enable privilege escalation: anyone with command execution on a VM can request its token and act with the identity's assigned roles.

Outlines five cloud security challenges—shadow IT, attacker-defender resource asymmetry, catastrophic misconfigurations—and argues purpose-built cloud penetration testing is the way to address them.

Compares cloud penetration testing across AWS and Azure, explaining the shared responsibility model and why platform-specific nuances matter for methodology and cloud security maturity.

From command execution on an Azure App Services host, attackers can inspect the environment, reach storage and Azure SQL, and abuse Managed Identity tokens to access Key Vaults and escalate.