Azure Attacks Unpacked: Real-World Threats & Lessons
summary
Summary of 10 concrete attack techniques rooted in MDDR 2025 telemetry: MFA cuts risk >99% yet >97% of attacks remain password sprays; legacy auth shows up as BAV2 ROC useragent and is exploitable; collaborative phishing via Teams and ClickFix clipboard trap leads to fileless PowerShell execution; device code phishing hands attackers tokens after users finish MFA; consent phishing grants API access without passwords; workload identity and token theft abuse Azure run command and stole data with info‑stealers like Redline; defenses include blocking legacy auth, conditional access, token revocation, run‑command monitoring, and inventory + least privilege.
AI-written summary · about
chapters (29)
- 0:00Welcome and MDDR Setup
- 0:59Passwords Still Dominate
- 1:58Legacy Auth in Logs
- 3:23Blocking Legacy Auth
- 5:16Roadmap for 10 Attacks
- 5:58Teams Phishing Playbook
- 7:48Defending Teams Abuse
- 8:38ClickFix Clipboard Trap
- 10:53ClickFix Mitigations
- 12:03Internet Exposure Scanning
- 13:44DevSecOps Supply Chain
- 15:50Hardening and Monitoring
- 19:08Device Code Phishing
- 21:00Stopping Device Code Abuse
- 22:57Session Hijacking Explained
- 24:21Token Theft Techniques
- 26:29Layered Token Defenses
- 28:15Consent Phishing Explained
- 30:44Stopping Illicit Consent Grants
- 32:49Temporary Access Pass Risks
- 34:01One Time Code Attacks
- 36:59Defending OTP and TAP
- 38:37Workload Identity Exposure
- 40:56Securing Service Principals
- 42:43Location Proximity and MFA Fatigue
- 45:36Mitigating MFA Bombing
- 47:21Post Breach Living Off Land
- 50:05Detecting and Preventing Persistence
- 52:16Key Takeaways and Wrap Up
related talks
48mLateral Movement in the Age of Hybrid Cloud
40mWhat’s Old is New: Hybrid Security for Microsoft Azure and On-Premises Tech
51mAdvanced Attack Vectors in Azure Environments
49mTop 5 ways to secure Azure resources
52mUncovering Azure's Silent Threats: A Journey Into Cloud Vulnerabilities
41mUncovering Azure's Silent Threats: A Journey into Cloud Vulnerabilities
55mOffensive Azure Security
40mFighting Where They Aren't: How Attackers Avoid Endpoints in Modern Attacks