Get-AzPasswords: Encrypting Automation Password Data

A walkthrough of MicroBurst's Get-AzPasswords, which harvests credentials from Azure Key Vaults, App Services, Automation Accounts, Storage Accounts, and container registries using Az PowerShell.

NetSPI shows how attackers can persist in Azure after privilege escalation using Automation Accounts, privileged runbooks, and webhook triggers that restore Owner access with a single POST request.

Karl Fosaaen starts an Azure Automation series, showing how runbook permissions allow attackers to export RunAs certificates and credentials for maintaining privileged access to Azure subscriptions.

Karl Fosaaen releases a script for anonymous Azure service enumeration, brute forcing DNS across azurewebsites.net, cloudapp.net, and blob.core.windows.net to map a target's public Azure footprint.

Karl Fosaaen introduces Get-AzurePasswords, a MicroBurst script that automates credential dumping from Azure Key Vaults, App Services configurations, and Automation Accounts via Azure PowerShell.

A now-patched Azure escalation path let Log Analytics Contributor abuse Automation Account rights to reach full Subscription Contributor via Run As accounts; walkthrough of the MSRC report included.