Category Archives: Monitoring & Detection

Bulk upload Log4Shell IoC to Microsoft Sentinel Threat Intelligence

Posted on 12/19/2021 by azsec

Log4Shell is an emerging threat and its exploit is still in the wild. As a SecOps analyst your job is to monitor your cloud assets ensure if there is any communication to known IoC you would have a proper action. … Continue reading →

Posted in Monitoring & Detection, Security Automation | Tagged , | 1 Comment

Detect Azure VM with a Public IP associated

Posted on 12/19/2021 by azsec

Last week a friend asked me if creating or updating a virtual machine where a public IP address was associated with was detectable. This is a very common requirement in cloud security monitoring. Having a workload (aka virtual machine) with … Continue reading →

Posted in Monitoring & Detection, Security Automation | Tagged , | Leave a comment

Detect NSG inbound rule updated to allow All

Posted on 12/18/2021 by azsec

Network Security Group (NSG) is one of the most common features in Azure to help strengthen your network defense. It allows you to filter network traffic to and from Azure resources. Having NSG in place doesn’t always mean your network … Continue reading →

Posted in Monitoring & Detection, Security Automation | Tagged , | Leave a comment

Laterally move by abusing Log Analytics Agent and Automation Hybrid worker

Posted on 11/09/2021 by azsec

Azure Automation Hybrid worker is used to manage Azure resources in local environment where compliant connectivity is needed. Normally a hybrid worker needs a certificate installed on it so it can be authorized by Azure AD before it can perform … Continue reading →

Posted in Monitoring & Detection, Security Operation | Tagged , | 1 Comment

Harvest credential from Custom Script Extension on Azure VM

Posted on 11/09/2021 by azsec

Custom Script Extension is one of the most commonly used extensions for Azure virtual machine deployment. This extension allows you to execute a bootstrapping script during VM deployment to perform some additional tasks.  Those tasks may include Domain Controller on-boarding … Continue reading →

Posted in Monitoring & Detection | Tagged , | 2 Comments

Notes on Azure Backup Soft-delete feature in a cybersecurity context

Posted on 07/22/2021 by azsec

Backup would be the last hope for you in an attempt of recovering your infrastructure after a cyber attack. Malware doesn’t only steal and exfiltrate data but also scans and deletes your backup. The soft delete feature is designed to … Continue reading →

Posted in Monitoring & Detection, Security Operation | Tagged | Leave a comment

Multi-homing Logging with new Azure Monitor Agent

Posted on 01/18/2021 by azsec

Sending logs from Azure virtual machine/virtual machine scale set to different Azure Log Analytics workspace (as known as multi-homing) is a common requirement in a large cloud environment. In the past Azure only supported configuring multi-homing on Windows virtual machine. … Continue reading →

Posted in Monitoring & Detection, Security Operation | Tagged , | 1 Comment

Alert Grouping feature in Azure Sentinel

Posted on 02/24/2020 by azsec

One of the things that SecOps guys needs when working with Azure Sentinel is the ability to group all alerts that have similar characteristics into a single incident in order to better manage and respond. Given an example about Traffic … Continue reading →

Posted in Monitoring & Detection | Tagged , | 3 Comments

Export virtual machines with ASC monitoring agent issue

Posted on 02/08/2020 by azsec

There is a recommendation named “Monitoring agent health issues should be resolved on your machine” in Azure Security Center that provides you list of unhealthy resources (virtual machine resource type). There are several reasons that can cause unhealthy monitoring state … Continue reading →

Posted in Monitoring & Detection | Tagged , | 1 Comment

What Blue Team needs to know about Run Script feature in Azure

Posted on 01/20/2020 by azsec

Run Script is great feature that help cloud system admin perform command or script execution on target virtual machine without RDP or setting up a PsRemote that may not be allowed in your organization. Nonetheless Run Script also allows bad … Continue reading →

Posted in Monitoring & Detection | Tagged , | 2 Comments