---
id: 8097
title: "Maintaining Azure Persistence via Automation Accounts"
source_domain: netspi.com
source_url: "https://www.netspi.com/blog/technical-blog/cloud-pentesting/maintaining-azure-persistence-via-automation-accounts/"
published_at: "2019-09-12T00:00:00Z"
tags: ["cloud", "cloud-security", "red-team", "azure", "persistence", "microburst", "automation-accounts", "runbook"]
phying_url: "https://phying.com/item/8097"
lang: en
---

# Maintaining Azure Persistence via Automation Accounts

## Summary

NetSPI shows how attackers can persist in Azure after privilege escalation using Automation Accounts, privileged runbooks, and webhook triggers that restore Owner access with a single POST request.

## Intelligence Metadata

- **Sources:** netspi.com
- **Published:** 2019-09-12T00:00:00Z
- **Original:** https://www.netspi.com/blog/technical-blog/cloud-pentesting/maintaining-azure-persistence-via-automation-accounts/
- **Phying News:** https://phying.com/item/8097