Azure Postexploit

Azure/Entra ID Post-Exploitation Methodology

154 programs across 13 categories — from basic enumeration to advanced Entra ID attacks, CIS compliance auditing, and M365 exploitation. All operations use az CLI and Microsoft Graph API.

Prerequisites

1. Valid Azure credentials — service principal, user credentials, managed identity, or access token
2. az CLI installed — az version
3. Current identity — verify access via az account show

# Quick prerequisite check
az account show    # verify Azure CLI credentials
az version         # verify CLI

Kill Chain Phases

Phase 1 — Situational Awareness (Recon: 47 programs)

Phase 2 — Credential Harvesting (14 programs)

Phase 3 — Privilege Escalation (11 programs)

Phase 4 — Identity Attacks (Entra ID: 10 programs)

Phase 5 — Lateral Movement (10 programs)

Phase 6 — Persistence (11 programs)

Phase 7 — Data Exfiltration (12 programs)

Phase 8 — M365 Exploitation (4 programs)

Phase 9 — Defense Evasion (11 programs)

Phase 10 — Compliance Audit (CIS Azure v3.0: 18 programs)

Phase 11 — Impact Assessment (5 programs)

Phase 12 — Cleanup (MANDATORY)

azurehook cleanup_azure

Detection Considerations

• Azure Activity Log — All ARM API calls, role assignments, resource creation
• Entra ID Audit Logs — App consent grants, credential additions, role activations
• Microsoft Defender for Cloud — Anomalous resource access, privilege escalation
• Conditional Access — Untrusted location/device blocks
• Azure Sentinel — UEBA, anomalous sign-in patterns, bulk data access
• Microsoft Graph Activity Logs — Graph API access to mail, files, teams

Program Reference