srl
Azure Cloud Red Teaming — Operator Notes
Practical field reference for assessing Microsoft Azure / Entra ID (formerly Azure AD) environments from an attacker’s seat. Covers initial access, identity validation, enumeration, privilege escalation, lateral movement, persistence, impact, detection/evasion, and tooling. The MCRTA “meta-tech.cloud” chain (§11) is the worked example.
Authorized engagements only. Every ARM/Graph call is logged in Activity Log / Entra audit logs; assume detection. Plan the OPSEC story before the action.
2025–2026 update: The Azure/Entra attack surface has expanded significantly. Federated Identity Credential (FIC) backdoors on managed identities and service principals are the new stealth persistence. OAuth Client ID Spoofing validates stolen credentials without generating a successful sign-in event. PRTremote extracts Primary Refresh Tokens via scheduled tasks over SMB. Key Vault backup/restore survives credential rotation. BloodHound CE v8+ with OpenGraph replaces the old Neo4j model. Storm-0501 and Storm-2949 demonstrate the full identity → Azure → ransomware kill chain. CVE-2026-62916 is a critical Entra ID authentication bypass.