Course Overview

This hands-on training aims towards abusing Azure and several services offered by it. We will

cover multiple complex attack lifecycles against a lab containing multiple live Azure tenants.

All the phases of Azure red teaming and pentesting – Recon, Initial access, Enumeration, Privilege Escalation, Lateral Movement, Persistence and Data mining are covered. We will also discuss detecting and monitoring for the techniques we use.

The course is a mixture of fun, demos, exercises, hands-on and lecture. The training focuses more on methodology and techniques than tools. If you are a security professional trying to improve your skills in Azure cloud security, Azure Pentesting or Red teaming the Azure cloud this is the right class for you!

Following topics are covered:

• Introduction to Azure and Entra ID

• Discovery and Recon of services and applications

• Enumeration

• Initial Access Attacks (Enterprise Apps, App Services, Function Apps, Insecure Storage,

• Phishing, Consent Grant Attacks, Device Code Auth Flow)

• Enumeration post authentication (Storage Accounts, Key vaults, Blobs, Automation

• Accounts, Deployment Templates etc.)

• Privilege Escalation (RBAC roles, Entra ID Roles, Across subscriptions)

• Lateral Movement (Pass-the-PRT, Pass-the-Certificate, Across Tenant, cloud to on-prem,

• on-prem to cloud)

• Lateral Movement (Across Tenant, cloud to on-prem, on-prem to cloud)

• Persistence techniques

• Data Mining

• Bypassing Defenses (MFA, Conditional Access, Defender for Cloud)

• Defenses, Monitoring and Auditing (CAP, PIM, Microsoft Defender for Cloud, JIT, Risk

policies, MFA, MTPs, Azure Sentinel)

Agenda

Day 1

• Introduction to Azure and Entra ID

• Discovery and Recon of services and applications

• Enumeration

• Initial Access Attacks (Enterprise Apps, App Services, Function Apps, Insecure Storage, Phishing, Consent Grant Attacks, Device Code Auth Flow)

Day 2

• Enumeration post authentication (Storage Accounts, Key vaults, Blobs, Automation Accounts, Deployment Templates etc.)

• Privilege Escalation (RBAC roles, Entra ID Roles, Across subscriptions)

• Lateral Movement (Pass-the-PRT, Pass-the-Certificate, Across Tenant, cloud to on-prem, on-prem to cloud)

Day 3

• Lateral Movement (Across Tenant, cloud to on-prem, on-prem to cloud)

• Persistence techniques (Hybrid Identity, Golden SAML, Service Principals, Dynamic

• Groups)

• Data Mining

• Bypassing Defenses (MFA, Conditional Access, Defender for Cloud)

• Defenses, Monitoring and Auditing (CAP, PIM, Microsoft Defender for Cloud, JIT, Risk

• policies, MFA, MTPs, Azure Sentinel)

Top 3 takeaways

• Understand and practice attacks on Azure in a live lab environment that has multiple Azure tenants and a large number of different resources including hybrid identity and on-prem infrastructure.

• Practice attacks on Azure in a live lab environment that has multiple Azure tenants and a

  large number of different resources including hybrid identity and on-prem infrastructure.

• Understand the defenses available to counter the discussed attacks and analyze the

  footprints of the attackers!

Why should people attend your course?

This course helps in upskilling to one of the most coveted skill in information security - Azure

security. Drawing from our experience of more than a decade to teach at hacker conferences, this hands-on course helps someone in improving their Azure security skills.

The course lab is designed in a way that students can solve it in multiple ways! The lab also

includes a CTF for those students who would like more challenge.