azure-postexploit

name	azure-postexploit
description	Azure/Entra ID post-exploitation for tenant compromise, Key Vault extraction, managed identity abuse, and token manipulation
category	post-exploitation
tags	["azure","entra-id","cloud","post-exploitation","keyvault","managed-identity","credential-access","persistence","token-abuse"]
tech_stack	["azure","az-cli"]
cwe_ids	["CWE-269","CWE-522","CWE-693","CWE-284"]
chains_with	["T1078.004","T1552.001","T1098.001","T1550.001","T1528"]
prerequisites	["T1078.004"]
version	1.0

Azure/Entra ID Post-Exploitation Methodology

Azure post-exploitation uses az CLI and native fetch() for IMDS access to perform tenant enumeration, privilege escalation, secret extraction, and persistence. No Python dependency — all operations use native TypeScript with az CLI calls.

Prerequisites

1. Valid Azure credentials — service principal, user credentials, managed identity, or access token
2. az CLI installed — az version
3. Current identity — verify access via az account show

# Quick prerequisite check
az account show    # verify Azure CLI credentials
az version         # verify CLI

Kill Chain Phases

Phase 1 — Situational Awareness

Action	Command	Purpose
Entra ID enum	azurehook entra_enum	Enumerate users, groups, apps, SPs, conditional access
Managed identity	azurehook managed_identity	Extract managed identity tokens from VM/App Service

Phase 2 — Privilege Escalation

Action	Command	Purpose
Consent grant	azurehook entra_privesc --method consent_grant	Illicit consent grant for Directory.ReadWrite.All
PIM activation	azurehook entra_privesc --method pim_activate	Activate eligible Global Administrator role
SP secret	azurehook entra_privesc --method sp_secret	Add client secret to existing service principal

Phase 3 — Data Exfiltration

Action	Command	Purpose
Key Vault dump	azurehook keyvault_dump	Extract secrets, keys, certificates from Key Vaults
Storage dump	azurehook storage_dump