Decrypting Azure VM Extension Settings with Get-AzureVMExtensionSettings

Stolen Azure Container Registry admin credentials enable Docker login, image and tag enumeration via Registry REST APIs, and pulling containers to hunt secrets; MicroBurst's Get-AzACR automates it.

A follow-up to managed identity research showing how to collect Azure OAuth bearer tokens from the portal, CLI, managed identities, Automation RunAs, and Cloud Shell, with new MicroBurst scripts.

Shows how Azure's Custom Script Extension and Run Command let a Virtual Machine Contributor run code as LocalSystem on any VM, even with RDP or SSH closed, enabling footholds and escalation.

NetSPI shows how attackers can persist in Azure after privilege escalation using Automation Accounts, privileged runbooks, and webhook triggers that restore Owner access with a single POST request.

Karl Fosaaen starts an Azure Automation series, showing how runbook permissions allow attackers to export RunAs certificates and credentials for maintaining privileged access to Azure subscriptions.

Karl Fosaaen releases a script for anonymous Azure service enumeration, brute forcing DNS across azurewebsites.net, cloudapp.net, and blob.core.windows.net to map a target's public Azure footprint.