Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Maintaining Azure Persistence via Automation Accounts

netspi.com | blog | #cloud | #cloud-security | #red-team | #azure | #persistence | #microburst | #automation-accounts | #runbook

Summary

NetSPI shows how attackers can persist in Azure after privilege escalation using Automation Accounts, privileged runbooks, and webhook triggers that restore Owner access with a single POST request.
Published
Collected

original ↗

Related coverage

blog · netspi.com
Get-AzurePasswords: Exporting Azure RunAs Certificates for Persistence
Karl Fosaaen starts an Azure Automation series, showing how runbook permissions allow attackers to export RunAs certificates and credentials for maintaining privileged access to Azure subscriptions.
blog · netspi.com
Get-AzPasswords: Encrypting Automation Password Data
Get-AzPasswords can expose Azure Automation credentials via runbook output; NetSPI added certificate-based CMS encryption so extracted passwords stay protected in logs and transit.
blog · netspi.com
Attacking Azure Container Registries with Compromised Credentials
Stolen Azure Container Registry admin credentials enable Docker login, image and tag enumeration via Registry REST APIs, and pulling containers to hunt secrets; MicroBurst's Get-AzACR automates it.
blog · netspi.com
Gathering Bearer Tokens from Azure Services
A follow-up to managed identity research showing how to collect Azure OAuth bearer tokens from the portal, CLI, managed identities, Automation RunAs, and Cloud Shell, with new MicroBurst scripts.
blog · netspi.com
Decrypting Azure VM Extension Settings with Get-AzureVMExtensionSettings
The Get-AzureVMExtensionSettings PowerShell script decrypts Azure VM extension settings stored on disk, potentially exposing sensitive parameters, storage account keys, and admin credentials.
blog · netspi.com
Using Azure Automation Accounts to Access Key Vaults
Karl Fosaaen shows how Contributor access to Azure Automation Accounts can be abused by modifying runbooks to dump secrets from Key Vaults, enabling attackers to read vault data without Owner rights.
back