hausec

10 posts in the catalog

Each feed is checked for new posts. Every post is read, and those that belong here join the catalog. What Trove read and did not keep stays on file, not shown.

hausec.comwriteup

Azure Storage Account Attacks and Detections

A hands-on Azure security writeup covering abuse of Shared Access Signature (SAS) tokens for blob storage (account-key vs. user-delegation signed tokens, and how to spot account-key SAS via the missing 'skoid' field in logs), and a cross-tenant object replication attack that exploits Azure's default-enabled cross-tenant replication (pre-Dec 2023) via the objectReplicationPolicies REST API to continuously exfiltrate blob data with minimal logging. It also provides several KQL detection queries against StorageBlobLogs, AzureActivity, AzureMetrics, and StorageFileLogs for spotting cross-tenant replication policy creation, anomalous user-agent strings, transaction-volume spikes, and Azure Files SMB read anomalies via SmbPrimarySID baselining. The piece closes with concrete hardening advice: prefer managed identities/Entra over SAS, disable cross-tenant replication, and build detections on configuration drift and stable client fingerprints.

AzureKQL

Cloud & Infra, Blue Team & Detection· 2025-12-15T16:38:35+00:00

hausec.comwriteup

Azure Virtual Machine Execution Techniques

Details five ways to execute code on an Azure VM beyond RDP/SSH: the Run Command agent, Custom Script Extension, Desired State Configuration (DSC) extension abuse, VM Application Definitions, and Hybrid Worker Groups — all running as SYSTEM/root by default. For each technique the author gives the exact PowerShell/Az cmdlets (including PowerZure's Invoke-AzureRunProgram and Invoke-AzureVMCustomScriptExtension), on-disk artifact paths, and the specific Azure Activity Log events (e.g. 'Run Command on Virtual machine', 'Create or Update Virtual Machine Extension') defenders should correlate on.

AzurePowerShellAzure CLI+1

Invoke-AzureRunProgramInvoke-AzureVMCustomScriptExtension

Offensive Security, Cloud & Infra, Blue Team & Detection· 2022-05-04T12:51:19+00:00

hausec.comarticle

PowerZure 2.1 Update

Release notes for PowerZure 2.1, a PowerShell Azure exploitation toolkit, detailing new offensive functions including Invoke-AzureVMUserDataAgent/Command which abuse the VM userData property for log-free command execution, and Invoke-AzureMIBackdoor which exposes the IMDS REST API externally via portproxying to steal Managed Identity JWTs without authentication. Also adds Get-AzureManagedIdentities and Get-AzurePIMAssignment for enumeration, plus several bug fixes to existing cmdlets.

PowerZurePowerShellAzure

IMDSManaged IdentityPIM

Offensive Security, Cloud & Infra· 2021-12-21T16:31:58+00:00

hausec.comwriteup

Abusing and Detecting Alternative Data Channel Command Execution on Azure Virtual Machines

Hausec details a covert command execution technique on Azure VMs abusing the userData property of the Instance Metadata Service (IMDS): an attacker with VM write privileges uses Invoke-AzVMRunCommand once to deploy a PowerShell "agent" that polls IMDS for base64-encoded commands, executes them, and exfiltrates results back via the Azure REST API using a smuggled access token — enabling repeat command execution without further RunCommand calls. The technique is implemented in PowerZure via Invoke-AzureVMUserDataCommand and Invoke-AzureVMUserDataAgent, and the post includes detection guidance covering artifact locations, Activity log alerts on Invoke-AzVMRunCommand, and PowerShell logging.

AzurePowerShellPowerZure

Invoke-AzVMRunCommandInvoke-AzureVMUserDataCommandInvoke-AzureVMUserDataAgent

Offensive Security, Cloud & Infra, Blue Team & Detection· 2021-12-03T14:51:42+00:00

hausec.comwriteup

Attacking Azure & Azure AD, Part II

Hausec (with Andy Robbins) details real-world Azure/Azure AD attack chains found on engagements: escalating a low-privileged Application Owner to Global Administrator via service principal secret abuse, then converting Azure AD Global Admin into Azure resource control via the User Access Administrator toggle (bypassing the fact that service principals can't invoke the API by creating a new admin user instead), pivoting from cloud to on-premise AD by uploading a Cobalt Strike PowerShell payload through Intune to hybrid-joined devices, and abusing Azure Logic App connector session persistence to reuse another account's privileges. The post accompanies the release of PowerZure 2.0, a rewritten offensive PowerShell toolkit implementing these abuses (Add-AzureSPSecret, New-AzureIntuneScript, Set-AzureElevatedPrivileges, Get-AzureLogicAppConnector, etc.).

AzureAzure Active DirectoryPowerZure+3

Andy RobbinsSean Metcalf

Cloud & Infra, Offensive Security, Identity & Access· 2021-10-26T14:44:44+00:00

hausec.comwriteup

Cobalt Strike and Tradecraft

A blog post breaking down Cobalt Strike's built-in "op-sec unsafe" commands (shell, pass-the-hash/pth, run, powershell, powerpick, spawnas) and mapping each to the exact Sysmon/Windows event log artifacts they generate: process creation chains (cmd.exe to conhost.exe with 0xffffffff -ForceV1), logon session events (4672, 4624, 4648), base64-encoded PowerShell command lines, and abnormal parent-child relationships like dllhost.exe spawning whoami.exe via fork-and-run techniques (powerpick, mimikatz, dcsync, execute-assembly, hashdump). It also flags quieter alternatives (BOFs, shinject, API-only calls) for a follow-up post, using a simple ELK plus Sysmon lab as the detection baseline.

Cobalt StrikeSysmonMimikatz+2

pass-the-hashfork-and-run

Offensive Security, Blue Team & Detection· 2021-07-26T15:46:20+00:00

hausec.comwriteup

Creating a Red & Blue Team Homelab

A step-by-step guide to building a home lab for practicing both red team (attack) and blue team (detection) skills, covering hardware/hosting choices, standing up a Windows Active Directory domain controller and workstation, deploying an ELK (Elasticsearch, Logstash, Kibana) stack on Debian for log analysis, and shipping Windows event logs (including Sysmon and PowerShell logging) to it via Winlogbeat. It's aimed at aspiring pentesters and threat hunters who want a safe environment to generate TTPs and study the resulting IOCs/detections.

Active DirectoryWindowsElasticsearch+5

Learning, Blue Team & Detection· 2021-03-04T16:36:15+00:00

hausec.comwriteup

AzureHound Cypher Cheatsheet

A cheatsheet of Cypher queries for use with AzureHound-collected data in BloodHound's GUI and the underlying Neo4j console, covering queries to find Global Admins, on-prem-to-Azure privilege escalation edges, paths to Azure VMs and Key Vaults, synchronized AD groups, privileged service principals, and app ownership. Links to the author's Bloodhound-Custom-Queries GitHub repo for importable JSON queries.

BloodHoundAzureHoundNeo4j+1

Offensive Security, Cloud & Infra, Identity & Access· 2020-11-23T14:58:58+00:00

hausec.comwriteup

Using a C# Shellcode Runner and ConfuserEx to Bypass UAC

A red-team engagement writeup describing how to convert djhohenstein's CSharp SetThreadContext shellcode runner into a DLL, using the DllExport NuGet package and x64 Release build settings, so it can be loaded via rundll32.exe. The DLL and a modified chryzsh Aggressor script implementing the SilentCleanup scheduled-task DLL-hijack UAC bypass are then run through ConfuserEx to evade Windows Defender detection, enabling a Cobalt Strike beacon to escalate from a medium-integrity to high-integrity token without a UAC prompt.

Cobalt StrikeWindows Defender.NET+3

SilentCleanup UAC bypassUACMEConfuserEx+1

Offensive Security· 2020-10-30T15:02:49+00:00

hausec.comarticle

Kerberosity Killed the Domain: An Offensive Kerberos Overview

A deep-dive walkthrough of how Kerberos authentication works in Active Directory (AS-REQ/AS-REP, TGT/TGS, PAC) and the corresponding attack primitives: AS-REP Roasting and Kerberoasting for offline hash cracking, Golden/Silver Ticket forgery via KRBTGT and service-account hashes, and the three delegation models (Unconstrained, Constrained via S4U2Self/S4U2Proxy, and Resource-Based Constrained Delegation) including printer-bug coercion, using tools like Rubeus, Mimikatz, PowerView, PowerMad, and SpoolSample.

KerberosActive DirectoryRubeus+3

kerberoastingAS-REP RoastingGolden Ticket+13

Offensive Security, Identity & Access· 2020-03-10T21:17:03+00:00