Azure - common misconfigurations
| Misconfiguration | Risk | What to look for |
|---|---|---|
| Storage account public blob access | high | allowBlobPublicAccess = true on storage account |
| Azure AD over-privileged apps | high | App registrations with Mail.Read, Directory.ReadWrite.All, etc. |
| NSG with 0.0.0.0/0 inbound | high | RDP/SSH/SQL/WinRM open to the internet |
| Key Vault broad access policies | medium | Vault policy grants * on secrets/keys/certs to many principals |
| VM managed identity with high privilege | medium | Identity has Contributor/Owner on subscription |
| Diagnostic logs disabled | low | No Activity Log, no resource logs sent to Log Analytics |
Common tools
| Tool | Purpose |
|---|---|
| MicroBurst | Azure offensive toolkit (PowerShell) |
| PowerZure | Azure recon and exploitation (PowerShell) |
| azucar | Azure security assessment |
| Stormspotter | Azure AD attack path mapping |
Useful commands
# login
az login
# whoami
az account show
# list subscriptions
az account list --output table
# find storage accounts with public blob access
az storage account list \
--query "[?allowBlobPublicAccess==\`true\`].name" --output tsv
# list NSGs and their rules
az network nsg list --output table
az network nsg rule list --nsg-name NAME --output table
# enumerate app registrations
az ad app list --query "[].{name:displayName, id:appId}" --output table
# enumerate key vaults and their access policies
az keyvault list --output table
az keyvault set-policy --name NAME --object-id ID --secret-permissions get list