Abusing Azure Hybrid Workers for Privilege Escalation – Part 1

Discover how an Azure user with the Subscription Reader role can compromise credentials or certificates from Automation Accounts and escalate to a Contributor level role.

A now-patched Azure escalation path let Log Analytics Contributor abuse Automation Account rights to reach full Subscription Contributor via Run As accounts; walkthrough of the MSRC report included.

Get-AzPasswords can expose Azure Automation credentials via runbook output; NetSPI added certificate-based CMS encryption so extracted passwords stay protected in logs and transit.

NetSPI shows how attackers can persist in Azure after privilege escalation using Automation Accounts, privileged runbooks, and webhook triggers that restore Owner access with a single POST request.

Karl Fosaaen shows how Contributor access to Azure Automation Accounts can be abused by modifying runbooks to dump secrets from Key Vaults, enabling attackers to read vault data without Owner rights.

Karl Fosaaen starts an Azure Automation series, showing how runbook permissions allow attackers to export RunAs certificates and credentials for maintaining privileged access to Azure subscriptions.