Category Archives: Security Operation

Extract plain-text password from Azure VM Reset Password feature

Posted on 01/28/2022 by azsec

Reset password is a common feature that allows you to create or reset a local administrator account on Azure VM. This feature is helpful when you forgot the account used to log into your VM. There would be a question … Continue reading →

Posted in Security Operation | Tagged | Leave a comment

Acquire Access Token from Azure App Service (Linux) System-Assigned Managed Identity

Posted on 12/30/2021 by azsec

I got a question from a friend last week if he should enable System-Assigned Managed Identity (SAMI) on an Azure App Service running on a Linux host. He also asked if his developer team could use that SAMI to do … Continue reading →

Posted in Security Operation | Tagged | Leave a comment

Count number of VMs & VMSS by OS type with Resource Graph Explorer

Posted on 11/18/2021 by azsec

As part of SOC work you may want to check in your Azure environment the number of VMs or VM Scalesets  by Operating System type so you can report to InfoSec leader. Moreover that helps plan security patching better. This … Continue reading →

Posted in Governance & Compliance, Security Operation | Tagged , | Leave a comment

Deploy Microsoft Defender for Servers via VM ARM template

Posted on 11/11/2021 by azsec

Microsoft Defender for Servers  offers you a capability for Azure VMs to help detect threat and to add additional defense. Currently it is supported on both Windows and Linux. In this article, let’s quickly check if we can deploy the … Continue reading →

Posted in Security Automation, Security Operation | Tagged | 7 Comments

Laterally move by abusing Log Analytics Agent and Automation Hybrid worker

Posted on 11/09/2021 by azsec

Azure Automation Hybrid worker is used to manage Azure resources in local environment where compliant connectivity is needed. Normally a hybrid worker needs a certificate installed on it so it can be authorized by Azure AD before it can perform … Continue reading →

Posted in Monitoring & Detection, Security Operation | Tagged , | 1 Comment

Notes on Azure Backup Soft-delete feature in a cybersecurity context

Posted on 07/22/2021 by azsec

Backup would be the last hope for you in an attempt of recovering your infrastructure after a cyber attack. Malware doesn’t only steal and exfiltrate data but also scans and deletes your backup. The soft delete feature is designed to … Continue reading →

Posted in Monitoring & Detection, Security Operation | Tagged | Leave a comment

Create an Azure Role Assignment Watchlist in Azure Sentinel

Posted on 07/13/2021 by azsec

Watchlist in Azure Sentinel allows you to build your own data from external data sources for correlation with analytics or hunting rules in your Azure Sentinel environment. In this article, what we are going to do is explore Azure Sentinel … Continue reading →

Posted in Security Automation, Security Operation | Tagged , | 5 Comments

Multi-homing Logging with new Azure Monitor Agent

Posted on 01/18/2021 by azsec

Sending logs from Azure virtual machine/virtual machine scale set to different Azure Log Analytics workspace (as known as multi-homing) is a common requirement in a large cloud environment. In the past Azure only supported configuring multi-homing on Windows virtual machine. … Continue reading →

Posted in Monitoring & Detection, Security Operation | Tagged , | 1 Comment

Guidance for CVE-2020-0796 SMBv3 Compression vulnerability patching on Azure VM

Posted on 03/13/2020 by azsec

There are discussions around a new CVE coded CVE-2020-0796 that Microsoft indicated a remote code execution vulnerability found in SMBv3.1.1 compression feature. There are questions from people working on Azure environment asking me what to do. The purpose of this … Continue reading →

Posted in Security Operation | Tagged , , | 1 Comment