Skip to content

35 results for “Azure”

ListGrid
What you seeeverything
RecentOldestAddedA–Z
All types90Write-ups35Articles31Repos13Advisories3
Other3Talks2Papers1Threads1Tools1
✍️ Write-ups“Azure”Clear all
stepsecurity.iowriteup🛡️ Security

Active Supply Chain Attack: Malicious node-ipc Versions Published to npm

StepSecurity's AI Package Analyst detected three malicious node-ipc versions (9.1.6, 9.2.3, 12.0.1) published simultaneously on May 14, 2026 by a rogue/compromised maintainer account, injecting an 80KB obfuscated IIFE into the CommonJS bundle that harvests 90+ credential file categories (AWS, Azure, GCP, SSH, Kubernetes, GitHub, Claude AI/Kiro configs, Terraform, etc.) and exfiltrates them via HTTPS and raw DNS TXT queries to a typosquatted Azure-mimicking C2 domain. The writeup includes a full stage-by-stage technical teardown (daemonization, SHA-256 targeting gate on 12.0.1, custom base-16 nibble-reversed obfuscation, dual-channel exfiltration) plus file hashes, network IOCs, and remediation guidance for developers and CI/CD pipelines.

node-ipcnpmNode.js+2
peacenotwarRIAEvangelistBrandon Nozaki Miller+2

Supply Chain, Threat Intel· Added 5 Oct 2026

binsec.nowriteup🛡️ Security

Binary Security: Azure Logic Apps cross-tenant compromises (One Root Case)

Third post in a series on Azure Logic Apps API Connections, describing five critical cross-tenant privilege escalations that let an attacker use any other tenant's connection to reach its backend (Key Vault, Azure SQL, Jira, Salesforce). Techniques include path traversal via ARM DynamicInvoke and undocumented DynamicList endpoints, and abusing the host.api.runtimeUrl parameter in Consumption Logic Apps, including a validation-before-normalization bypass. The author reports $200,000 in bounties; Microsoft fixed all issues.

AzureAzure Logic AppsAzure API Management+3
path traversalDynamicInvokeDynamicList+5

Cloud & Infra, AppSec, Offensive Security· Added 30 Oct 2026, published 2 Oct 2026

microsoft.comwriteup🛡️ Security

​​Beyond source code: A path to the keys to the kingdom

Microsoft's DART team details an investigation into Storm-3068, a threat actor that escalated from a self-service password reset account takeover into full control of an organization's Azure DevOps environment, then weaponized a malicious pipeline to harvest kubeconfig files and gain access to Kubernetes clusters. The actor also deployed the Atera remote management agent and the Chisel tunneling tool to establish reverse tunnels and alternate remote access, and exfiltrated seven stolen kubeconfig files into a repository. The report lays out the attack chain, DART's response, and hardening recommendations around SSPR monitoring, phishing-resistant MFA, branch protection, and pipeline permission controls.

Azure DevOpsKubernetesAtera+3
Storm-3068

Threat Intel, Cloud & Infra, Identity & Access· Added 7 Oct 2026, published 29 Sep 2026

microsoft.comwriteup🛡️ Security

Storm-3168: Agentic-driven cloud attacks using compromised service principals

Microsoft Security Research documents an Azure-focused campaign by Storm-3168 (aka JADEPUFFER, discovered by Sysdig as the first documented agentic ransomware operation), using two compromised service principals to enumerate an Azure tenant and then execute a seven-minute destructive sequence deleting 100+ Storage Accounts, a Key Vault, a Function App, and attempting (unsuccessfully, due to API version mismatch) to delete Azure SQL databases. Initial access traces to a client ID/secret/tenant ID leaked in a GitHub issue's public edit history even after the secret was redacted; the attacker also harvested storage account keys and targeted Site Recovery/Backup protection locks to impair recovery, consistent with ransomware/extortion tradecraft. The post includes a MITRE ATT&CK mapping (T1190, T1078.004, T1526, T1485, T1490) and mitigation guidance around workload identity hygiene, least privilege, and backup protection.

AzureMicrosoft Defender XDRMicrosoft Defender+3
Storm-3168JADEPUFFERSysdig+7

Threat Intel, Cloud & Infra, AI Security· Added 7 Oct 2026, published 25 Sep 2026

wiz.iowriteup🛡️ Security

The Infostealer Incursion: How Stolen Credentials Breach Cloud, Code, and AI Environments

Wiz Research analyzed infostealer-harvested secrets (via its NordStellar integration) to map exactly which credentials malware families like Lumma, RedLine, and Vidar target across AWS, Azure, GCP, GitHub, GitLab, and AI platforms, and how those secrets translate into cloud account takeover. It gives concrete file paths and artifacts attackers hunt for (~/.aws/sso/cache OIDC tokens, Azure accessTokens.json, GCP credentials.db/access_tokens.db, GitHub gh hosts.yml and SSH keys, GitLab Runner config.toml, OpenAI/ChatGPT session cookies, and Claude Code's ~/.claude/.credentials.json OAuth tokens), plus stats: three malware families cause 85.7% of incidents, AWS/GCP account for 46%/13% of stolen secrets, GitHub ~10%, AI platforms ~5%. It also covers CI/CD-targeting infostealers (Miasma, TeamPCP) and session-cookie hijacking as an MFA bypass technique.

AWSAzureGCP+3
CVE-2023-7028LummaRedLine+11

Threat Intel, Cloud & Infra, Identity & Access· Added 27 Sep 2026, published 25 Sep 2026

endorlabs.comwriteup🛡️ Security

Shai-Hulud 2 Malware Campaign Targets GitHub and Cloud Credentials Using Bun Runtime | Blog | Endor Labs

Endor Labs' live incident tracker for the Shai-Hulud 2.0 npm supply-chain worm that began around Nov 24, 2025, compromising packages from Zapier, ENS Domains, Postman and PostHog. It details the infection chain (malicious preinstall script, setup_bun.js dropper, obfuscated bun_environment.js payload), TruffleHog-style credential theft from AWS, GCP, Azure, GitHub and npm, self-replication via stolen npm and GitHub tokens, a self-hosted GitHub Actions runner backdoor abusing repository Discussions for command injection and C2, and destructive wiper behavior that shreds the user's home directory on Windows and Linux.

npmBunGitHub Actions+3
Shai-Hulud 2.0Shai-HuludZapier+3

Supply Chain, Threat Intel, DevSecOps· Published and added 11 Sep 2026

stepsecurity.iowriteup🛡️ Security

Megalodon: Mass GitHub Actions Secret Exfiltration Across 5,500+ Public Repositories - StepSecurity

StepSecurity documents Megalodon, a May 2026 campaign that injected backdoored GitHub Actions workflow files named SysDiag or Optimize-Build directly into 5,500+ public repositories in a six-hour window via direct Poisoned Pipeline Execution (d-PPE), exploiting weak branch protection. The base64-encoded bash payload harvests AWS/GCP/Azure credentials, SSH keys, Kubernetes/npm/Docker configs, GitHub OIDC tokens, and grep-matched secrets from the workspace, exfiltrating everything via HTTPS POST to a hardcoded C2 IP; the npm package @tiledesk/tiledesk-server was among the confirmed poisoned downstream targets.

GitHub ActionsnpmStepSecurity+3
MegalodonT1195.002Tiledesk+8

Supply Chain, DevSecOps, Threat Intel· Added 5 Sep 2026

huntress.comwriteup🛡️ Security

The Crypto Wallet That Never Opened: Tampered Exodus Installer Hides a Modular RAT

Huntress dissects a trojanized Exodus crypto wallet installer (v24.33.4, unsigned MSI built with WiX) that installs a genuine wallet but patches Electron's show()/focus()/center() methods so no window ever appears, then loads a modular RAT via a hand-written reflective PE loader implemented in JavaScript using the Node.js koffi FFI library. The RAT (VNC, SOCKS proxy, browser-credential stealer, recon module) beacons over WebSockets and uses Azure Table Storage as a dead-drop C2 channel to blend into legitimate cloud traffic, while delivery abuses double-extension .pdf.js phishing, ZIP-staged JS files, and an unused search-ms/WebDAV technique; the writeup also covers multi-layer string-array/arithmetic deobfuscation and includes full IOCs and mitigation guidance.

ExoduskoffiWindows+3
ClickFix

Malware & RE, Threat Intel, Blue Team & Detection· Added 3 Sep 2026, published 1 Sep 2026

ionix.iowriteup🛡️ Security

We built an AI PR reviewer. The hard part was teaching it to say nothing.

Ionix's engineering team describes building an in-house AI PR reviewer using OpenAI's Codex CLI against a self-hosted Azure AI Foundry model deployment, wired into CircleCI and Bitbucket, after dropping Atlassian Rovo for cost and low signal-to-noise. The piece details prompt design to suppress low-value comments, agentic repo-wide review (vs. diff-only), sharding for large PRs, JSON output validation against git ls-files, storing review state inside PR comments via base64-in-markdown, and a dedicated prompt-injection defense section (scrubbed environment, secret redaction, sandboxed execution, egress restriction). It also covers two production failures: a silently-broken bubblewrap sandbox that kept "reviewing" without running any tools, and an unpinned Codex CLI npm dependency that broke Azure API calls across every repo.

Codex CLIAzureFoundry+3

AI Security, DevSecOps· Added 3 Sep 2026, published 13 Aug 2026

wiz.iowriteup🛡️ Security

Cloud Threat Highlights: H1 2026

Wiz's H1 2026 cloud threat report documents a 60% jump in significant incidents driven by a doubling of supply-chain attacks (TeamPCP's npm/PyPI/GitHub Actions credential-harvesting spree, its open-sourced Shai-Hulud worm spawning Miasma/Hades/Megalodon/IronWorm follow-ons, North Korea's axios and @mastra trojanizations) and by growing attacks on AI infrastructure, including exposed unauthenticated MCP servers, LiteLLM/Dify/Langflow/n8n/Ollama vulnerabilities, and cryptominers deployed via a Langflow RCE. It also profiles JINX-0163, a cloud-native extortion group targeting non-human identities (service accounts/IAM roles) across AWS/Azure/GCP/Okta/Snowflake linked to the "FulcrumSec" extortion brand, and closes with concrete detection techniques for stolen access keys, Kubernetes VM Run Command abuse, GCP org-policy tampering, and CloudTrail user-agent/boto3 credential-provenance mismatches.

npmPyPILiteLLM+3
TeamPCPShai-HuludMiasma+11

Supply Chain, Threat Intel, AI Security, Cloud & Infra· Added 3 Sep 2026, published 6 Aug 2026

wiz.iowriteup🛡️ Security

CosmosEscape: Taking Over Every Database in Azure Cosmos DB

Wiz Research found CosmosEscape, a critical Azure Cosmos DB vulnerability exploited via the Gremlin API's .NET-based query engine, whose sandbox failed to restrict .NET reflection, enabling arbitrary code execution on the DB Gateway service. This allowed retrieval of the "Cosmos Master Key," a platform-wide signing key that could fetch any Cosmos DB account's primary key and enumerate accounts via a shared Config Store, enabling attackers to compromise any customer or internal Microsoft database (including those backing Entra ID, Teams, and Copilot) from public endpoints. Microsoft fully remediated the issue and eliminated the master key architecture.

Azure Cosmos DBGremlin.NET+1
CosmosEscapeCosmos Master KeyConfig Store+1

Cloud & Infra, Offensive Security· Added 3 Sep 2026, published 30 Jul 2026

manifold.securitywriteup🛡️ Security

When Your AI Reviewer Works for the Attacker: A Confused-Deputy Bug in Microsoft

Manifold Security researchers found that Microsoft's official Azure DevOps MCP server fails to consistently apply its 'spotlighting' guardrail (added in PR #1062) to untrusted content: pipeline and wiki tools wrap external content in delimiters, but the tool returning PR descriptions does not. An attacker with contributor access to one project can hide prompt-injection instructions inside an HTML comment in a PR description (invisible in the Azure DevOps UI but returned verbatim by the API), which hijacks a reviewing victim's AI agent (tested with Copilot CLI and Claude Code) into running pipelines and reading a confidential wiki page in a separate project the attacker can't access, then exfiltrating the content back as a PR comment — a classic confused-deputy / lethal-trifecta scenario. The issue was reported to and triaged by MSRC.

Azure DevOpsModel Context ProtocolClaude Code+1
MSRClethal trifectaSimon Willison

AI Security, AppSec· Added 23 Jul 2026, published 21 Jul 2026

socket.devwriteup🛡️ Security

jscrambler npm Package Compromised in Supply Chain Attack

Socket's research team documents a supply chain compromise of the jscrambler npm package (v8.14.0+), where a stolen publishing credential was used to push malicious releases that drop platform-specific Rust-built infostealer binaries via a preinstall hook. The campaign evolved over the incident to evade scanners by moving the dropper from install scripts into a self-executing function inside index.js/CLI code (defeating --ignore-scripts), and the payload targets crypto wallets, cloud credentials (AWS/GCP/Azure), browser data, Discord/Slack/Telegram, and notably AI coding assistant configs (Claude Desktop, Cursor, Windsurf, VS Code) for MCP server credentials. Includes detailed RE of the ChaCha20-Poly1305 string-encryption scheme and full IOC hash list.

JscramblernpmRust+3

Supply Chain, Malware & RE· Added 21 Sep 2026, published 11 Jul 2026

huntress.comwriteup🛡️ Security

No (Bad) CAP: Inside an Ongoing LSHIY Password Spray Attack

Huntress tracked a large, ongoing password spray campaign against Microsoft 365/Azure CLI using the deprecated OAuth ROPC (Resource Owner Password Credentials) flow, which sends passwords directly to the /token endpoint and bypasses MFA prompts enforced via Conditional Access Policies. Between June 12-26, over 81 million login attempts from LSHIY LLC's IPv6 range (AS32167) compromised 78 accounts across 64 organizations, many of which had MFA enabled but scoped incorrectly (app-specific, group-specific, trusted-location exceptions, or report-only mode). After LSHIY terminated the abusive BYOIP customer, attackers pivoted to FranTech (AS53667) and then 3xK Tech GmbH (AS200373), rotating through ~12,800 IPv4 addresses at low per-IP volume to evade detection while sustaining ~1.5 million login attempts/day.

Microsoft 365Azure CLIOAuth+2
LSHIY LLCAS32167AS955+4

Threat Intel, Identity & Access· Added 3 Sep 2026, published 30 Jun 2026

stepsecurity.iowriteup🛡️ Security

Miasma Worm Hits Microsoft Again: Azure Functions Action and 72 Other Repositories Disabled After Supply Chain Attack Targeting AI Coding Agents

StepSecurity's forensic analysis of the June 5, 2026 Miasma worm incident, in which a compromised contributor account pushed a malicious commit to Microsoft's Azure/durabletask repository planting five files (.claude/settings.json, .gemini/settings.json, .cursor/rules/setup.mdc, .vscode/tasks.json, and a 4.6MB obfuscated .github/setup.js payload) that trigger credential-harvesting code execution the moment the repo is opened in Claude Code, Gemini CLI, Cursor, or VS Code — no package install or code run required. GitHub's automated abuse detection disabled 73 Microsoft repositories in a 105-second sweep, including Azure/functions-action, breaking CI/CD pipelines across GitHub Actions users relying on the mutable @v1 tag. The post ties this to the same compromised account behind the May 19 durabletask PyPI credential-stealer campaign and the broader TeamPCP-linked Miasma worm, which has infected 113+ repositories.

Claude CodeGemini CLICursor+4
Miasma wormTeamPCPt.m-kosche.com+6

Supply Chain, AI Security, DevSecOps· Added 3 Sep 2026, published 9 Jun 2026

stepsecurity.iowriteup🛡️ Security

Microsoft's durabletask PyPI Package Compromised in Supply Chain Attack

StepSecurity documents the compromise of Microsoft's durabletask PyPI package (versions 1.4.1-1.4.3, 400k+ monthly downloads), where an attacker bypassed the GitHub CI/CD pipeline entirely using stolen publishing credentials to inject a dropper for rope.pyz, a modular cloud-intrusion framework with dedicated collectors for AWS, Azure, GCP, Kubernetes, HashiCorp Vault, password managers, and the filesystem. The framework encrypts stolen data with AES-256-GCM/RSA-4096, exfiltrates via HTTPS, GitHub commit beacons, and attacker-created public repos using the victim's own stolen GitHub tokens, propagates via AWS SSM and kubectl exec, and drops a geo-targeted rm -rf wiper for systems matching Israeli locale/timezone markers. The post ties the attack to TeamPCP's Mini Shai-Hulud campaign (same infrastructure as TanStack, Mistral AI, LiteLLM, @antv) and later updates describe a second compromise of the Azure/durabletask GitHub repo that plants payloads triggering in Claude Code, Gemini CLI, Cursor, and VS Code.

PythonPyPIHarden-Runner+3
CVE-2026-45321TeamPCPMini Shai-Hulud+4

Supply Chain, Threat Intel, Malware & RE· Added 3 Sep 2026, published 9 Jun 2026

opensourcemalware.comwriteup🛡️ Security

Miasma Blight Reaches Microsoft: 73 Repos Disabled in 105 Seconds

Investigates GitHub's mass disabling of 73 Microsoft repositories across the Azure, Azure-Samples, microsoft, and MicrosoftDocs orgs within a 105-second window on June 5, all flagged for ToS violations, including the widely-used Azure/functions-action GitHub Action that broke CI pipelines globally. The author links the takedown to a re-compromise of the durabletask PyPI package (previously hit May 19 by TeamPCP via stolen GitHub Actions secrets) and to Miasma, a rebrand of TeamPCP's open-sourced Mini Shai-Hulud worm that Aikido and OX Security found had added Azure/GCP credential collectors and self-propagates by committing stolen secrets into attacker-created public repos, which is what likely triggered GitHub's automated abuse enforcement.

npmPyPIGitHub Actions+3
TeamPCPMiasmaMiasma worm+5

Supply Chain, DevSecOps, Threat Intel· Added 3 Sep 2026, published 6 Jun 2026

snyk.iowriteup🛡️ Security

Node-gyp Supply Chain Compromise: A Self-Propagating npm Worm That Hides in binding.gyp

Snyk documents an active npm supply-chain attack ("Node-gyp Supply Chain Compromise - June 2026") that abuses binding.gyp's GYP command-expansion syntax (<!(...)) to trigger arbitrary code execution via node-gyp during npm install, bypassing detection tools that only monitor preinstall/postinstall scripts. The worm, tracked as "Phantom Gyp"/"Miasma" (a Shai-Hulud descendant) by StepSecurity, has hit 57 packages including autotel-* and @vapi-ai/server-sdk, harvests npm/GitHub/AWS/GCP/Azure/Vault/Kubernetes credentials via a multi-stage obfuscated Bun-based loader, injects GitHub Actions workflows for persistence, and self-propagates by republishing from compromised maintainer accounts.

npmnode-gypGitHub Actions+2
binding.gypPhantom GypMiasma+5

Supply Chain, Malware & RE, Threat Intel· Added 3 Sep 2026, published 4 Jun 2026

aikido.devwriteup🛡️ Security

Red Hat npm Packages Compromised to Spread a Credential-Stealing Worm

Aikido details a June 2026 compromise of 96 versions across 32 @redhat-cloud-services npm packages (116,991 weekly downloads) with "Miasma," a new variant of the TeamPCP-authored Mini Shai-Hulud credential-stealing worm whose source was open-sourced in May 2026. Attackers compromised a Red Hat employee's GitHub account to push malicious orphan commits containing a GitHub Actions workflow that abused OIDC id-token: write permissions to authenticate to npm's trusted publishing endpoint and republish backdoored packages; each package's preinstall script then ran a 4.2MB obfuscated payload that swept GitHub Actions, AWS, GCP, Azure, Vault, Kubernetes, npm/PyPI, SSH, Docker, GPG, and .env credentials. The piece also lays out the broader Mini Shai-Hulud campaign timeline (Bitwarden CLI, SAP, PyTorch Lightning, Mistral/TanStack, Microsoft DurableTask) and full IOC package/version list.

npmGitHub ActionsOIDC+2
TeamPCPMini Shai-HuludMiasma+3

Supply Chain, DevSecOps, Threat Intel· Added 3 Sep 2026, published 1 Jun 2026

socket.devwriteup🛡️ Security

Socket: node-ipc npm Package Compromised

Socket's threat research team details a fresh compromise of the npm package node-ipc, where dormant maintainer account "atiertant" was hijacked via an expired recovery-email domain and used to publish three malicious versions (9.1.6, 9.2.3, 12.0.1) containing an obfuscated credential-stealing backdoor appended only to the CommonJS build. The payload forks a detached child process, harvests cloud/SSH/CI/database credentials and secrets from the filesystem and environment, archives them, and exfiltrates via covert DNS TXT queries to a typosquatted Azure-lookalike domain (sh.azurestaticprovider.net) and zone bt.node.js, with no observed C2 response handling or persistence. The write-up includes the full decode chain (XOR+HMAC+base64 obfuscation), dynamic validation, and complete IOCs (hashes, domains, temp file paths).

npmNode.jsSocket
atiertantIan AhlTekDefense+4

Supply Chain, Malware & RE, Blue Team & Detection· Published and added 30 May 2026

fossa.comwriteup🛡️ Security

FOSSA: Mini-Shai-Hulud Mass Compromise

FOSSA's technical breakdown of the May 2026 Mini-Shai-Hulud campaign, which compromised at least 235 npm and PyPI packages including @tanstack/*, @uipath/*, mistralai, and @opensearch-project/opensearch. It details the two install-time payload mechanisms (a Git-dependency prepare-hook trick with an orphan commit for @tanstack/*, and direct preinstall scripts for @uipath/*/Mistral AI), a staged PyPI dropper in __init__.py that evades sandbox scanning, the credential-harvesting targets (AWS/GCP/Azure, Kubernetes, Vault, GitHub, npm tokens), exfiltration infrastructure (filev2.getsession.org, git-tanstack.com), and IDE-persistence via modified Claude/VS Code config files.

npmPyPITanStack+3
Mini Shai-HuludUiPathMistral AI+8

Supply Chain, Threat Intel· Published and added 18 May 2026

microsoft.comwriteup🛡️ Security

When Prompts Become Shells: RCE Vulnerabilities in AI Agent Frameworks (Semantic Kernel)

Microsoft discloses two CVEs in its Semantic Kernel AI agent framework: CVE-2026-26030, where AI-model-controlled input into an eval()-executed Python lambda filter (used by the In-Memory Vector Store's Search Plugin) bypasses an AST-based blocklist via class-hierarchy traversal to BuiltinImporter.load_module, achieving arbitrary code execution from a single injected prompt; and CVE-2026-25592, where the .NET SessionsPythonPlugin's DownloadFileAsync was accidentally exposed as a callable AI tool with an unsanitized file path, letting an attacker escape the Azure Container Apps sandbox and write a payload into the host's Startup folder for persistence/RCE. The post details the exploit chains (mapped to MITRE ATLAS AML.T0051→AML.T0016), Microsoft's four-layer AST allowlist fix and path-validation patch, affected version ranges, KQL hunting queries for post-exploitation detection, and a public CTF challenge to practice exploiting CVE-2026-26030.

Semantic KernelLangChainCrewAI+3
CVE-2026-26030CVE-2026-25592AML.T0051 (LLM Prompt Injection)+2

AI Security, AppSec, Blue Team & Detection· Added 2 Oct 2026, published 7 May 2026

socket.devwriteup🛡️ Security

Socket: Bitwarden CLI Compromised in Checkmarx Supply Chain Campaign

Socket researchers found that Bitwarden CLI 2026.4.0 was compromised via a hijacked GitHub Action in Bitwarden's CI/CD pipeline, part of the ongoing Checkmarx-themed supply chain campaign. The malicious bw1.js payload shares C2 infrastructure and code (gzip+base64 packed Python memory-scraper, Bun-based runtime, GitHub Actions workflow injector) with the earlier Checkmarx mcpAddon.js attack, but adds new indicators like a lock file, shell-profile persistence, and overt "Shai-Hulud: The Third Coming" / Butlerian Jihad ideological branding, plus a kill switch for Russian-locale systems. It harvests GitHub, AWS, Azure, GCP, npm, SSH, and Claude/MCP credentials and exfiltrates via GitHub commits and npm republishing.

npmGitHub ActionsBun
BitwardenBitwarden CLICheckmarx+2

Supply Chain, Threat Intel, DevSecOps· Published and added 6 May 2026

hausec.comwriteup🛡️ Security

Azure Storage Account Attacks and Detections

A hands-on Azure security writeup covering abuse of Shared Access Signature (SAS) tokens for blob storage (account-key vs. user-delegation signed tokens, and how to spot account-key SAS via the missing 'skoid' field in logs), and a cross-tenant object replication attack that exploits Azure's default-enabled cross-tenant replication (pre-Dec 2023) via the objectReplicationPolicies REST API to continuously exfiltrate blob data with minimal logging. It also provides several KQL detection queries against StorageBlobLogs, AzureActivity, AzureMetrics, and StorageFileLogs for spotting cross-tenant replication policy creation, anomalous user-agent strings, transaction-volume spikes, and Azure Files SMB read anomalies via SmbPrimarySID baselining. The piece closes with concrete hardening advice: prefer managed identities/Entra over SAS, disable cross-tenant replication, and build detections on configuration drift and stable client fingerprints.

AzureKQL

Cloud & Infra, Blue Team & Detection· Added 3 Sep 2026, published 15 Dec 2025

winternl.comwriteup🛡️ Security

Unpacking the AAD Broker LocalState Cache

Deep technical teardown of the Entra ID (Azure AD) Broker's LocalState cache on Windows 11, reverse-engineering the file naming scheme derived from identity material, the AES-GCM/DPAPI-wrapped Packer::V3 format inside AAD.Core.dll, and the JSON/binary serialization of AuthenticationContext objects used for PRT and per-application authority files. The author shows how to decrypt cached PRT and authority token files, derive the TPM-bound PRT session key via NCryptKeyDerivation (replicating mimikatz's dpapi::cloudapkd), and extract cached access/refresh tokens and JWTs — giving an attacker with local SYSTEM context a path to long-lived, MFA-bypassing cloud access and rich identity reconnaissance data. Companion extraction code is released as AADBrokerDecrypt on GitHub.

Microsoft Entra IDWindowsMimikatz
AAD BrokerPrimary Refresh Token (PRT)AADBrokerDecrypt

Offensive Security, Identity & Access· Added 2 Oct 2026, published 30 Sep 2025

huntress.comwriteup🛡️ Security

6 Months of Researching OAuth Application Attacks | Huntress

Huntress details six months of research into malicious Azure/Entra ID OAuth applications, splitting them into "Traitorware" (legitimate-looking apps commonly abused by attackers, ~10% of surveyed tenants had at least one) and "Stealthware" (custom-built OAuth Illicit Consent Grant apps used for persistence and data theft). Drawing on enumeration of 8,000+ tenants and Huntress partner telemetry, the SOC found over 500 confirmed Stealthware instances and identifies detection heuristics (low global app prevalence + single-user delegation + powerful permission scopes). The post also announces Cazadora, an open-source script that authenticates via Graph API to hunt rogue Enterprise Applications and App Registrations for known malicious naming patterns and reply URLs.

AzureMicrosoft 365OAuth+2
TraitorwareStealthwareOAuth Illicit Consent Grant Attack+2

Identity & Access, Blue Team & Detection· Added 3 Sep 2026, published 10 Feb 2025

huntress.comwriteup🛡️ Security

Device Code Phishing: OAuth 2.0 Attacks in Google & Azure

A Huntress researcher walks through Device Code Phishing, an OAuth 2.0 device authorization grant abuse technique, and shows why it is far more dangerous against Azure/Microsoft 365 than against Google Cloud. In Azure, the attacker controls the requested resource and can use Microsoft's undocumented "Family of Client IDs" (e.g. the Microsoft Authentication Broker client ID) to phish a Primary Refresh Token capable of joining rogue devices, enrolling MFA, and full account takeover; Google's device code implementation restricts the flow to a handful of narrow scopes (GDrive file access, YouTube read-only) and requires a registered/verified OAuth app, neutering the same attack. The piece includes working curl/Python requests for both providers and references prior research by Dirk-jan Mollema, Nestori Syynimaa, and Lina Lau.

OAuthAzureGoogle Cloud+3
Family of Client IDsPrimary Refresh TokenMicrosoft Authentication Broker+4

Identity & Access, Offensive Security· Added 3 Sep 2026, published 6 Feb 2025

dfir.chwriteup🛡️ Security

Today I Learned - NSG Flow Log

A short DFIR.ch "Today I Learned" post walking through enabling Azure NSG Flow Logs (v2), storing them in a Storage Account, and parsing the flowTuple JSON schema (timestamp, src/dst IP/port, protocol, direction, allow/deny, flow state B/C/E). It highlights use cases like detecting RDP brute-force attempts and integrating logs into Sentinel/Splunk/ELK for network monitoring and incident response.

AzureAzure MonitorMicrosoft Sentinel+2
DefaultRule_AllowInternetOutBoundDefaultRule_DenyAllInBoundUserRule_RDP

Cloud & Infra, Blue Team & Detection· Added 3 Sep 2026, published 21 Sep 2024

attackthesoc.comwriteup🛡️ Security

Stack Your Deception: Stacking MDE Deception Rules with Thinkst Canarytokens

A practical deception-engineering guide showing how to "stack" Microsoft Defender XDR's native Deception rules (basic/advanced lures, decoy hosts, credentials) with Thinkst Canarytokens (tokenized PDFs, custom EXEs, DNS/AWS-key tokens) to close detection gaps. It walks through generating tokens on Canarytokens.com, embedding them as lure files in Defender XDR deception rules, and routing alerts via email/Teams/Slack or an Azure Logic App into Microsoft Sentinel for SOC-integrated incident creation.

Microsoft Defender XDRCanarytokensMicrosoft Sentinel+2
Thinkst Applied Research

Blue Team & Detection· Added 3 Sep 2026, published 21 Apr 2024

dfir.chwriteup🛡️ Security

Azure Batch Misused for Crypto Mining

dfir.ch documents an incident where an attacker with a compromised (non-MFA) Azure admin account created Azure Batch accounts, requested a Microsoft Support quota increase to unlock compute, and used a Batch pool StartTask to pull a Docker container (ubtssl/webappx) running the xm coin miner against a mining pool. The post walks through Azure Batch internals (accounts, pools, StartTask, quotas), shows the actual Activity Log JSON and malicious bash/Docker config, and recommends MFA, risky sign-in monitoring, and anomaly alerting as mitigations.

AzureDockerMicrosoft Entra ID
ubtssl/webappxxm miner

Cloud & Infra, Blue Team & Detection· Added 3 Sep 2026, published 15 Mar 2024

Showing 30 of 35

Show more