☁️
CTHFM: Azure
  • Welcome
  • Getting Started
    • Account Setup
      • Account Creation Instructions
  • Azure Fundamentals
    • Azure Fundamentals Overview
      • Azure Documentation
      • Azure Entra
      • Azure Hierarchy
      • Identities
      • Azure Entra Roles
      • Azure RBAC
      • Azure Licensing Overview
        • Azure Entra ID Premium Licenses Comparison
      • Azure Shared Responsibility Model
      • Azure Frameworks
      • Azure Security Services
      • Conditional Access Policies
        • How Conditional Access Policies Work
        • Benefits of Conditional Access
        • Best Practices for Conditional Access
        • Conditions for Conditional Access
        • Conditional Access Controls
        • Sign-In Risk and Identity Protection
        • Conditional Access Session Control
        • Name Locations IP Location
      • Azure Quotas
      • Azure Tokens
        • Access Tokens
        • ID Tokens
        • Refresh Tokens
          • Invalidate Refresh Tokens
        • Primary Refresh Tokens
        • Continuous Access Evaluation (CAE)
        • Token Protection: Conditional Access (Public Preview)
  • Azure CLI
    • Introduction to Azure CLI
    • Installing Azure CLI
    • CLI Commands
    • Resource Group Management
    • Creating and Managing Resources with Azure CLI
    • Managing IAM
    • Azure CLI Automation
    • Monitoring and Troubleshooting in Azure CLI
    • Azure CLI Overview
      • Azure CLI: Linux
      • Azure CLI: Windows
      • Azure CLI: MacOS
  • KQL
    • KQL Overview
      • KQL Introduction
      • Data Types
      • Quick Reference
      • Render
      • Basic Queries
  • Powershell
    • PowerShell for Azure
      • Powershell Documentation
      • Powershell Basics
      • Understanding Powershell Variables
      • Understanding Cmdlets
      • Powershell Console & ISE
      • Powershell: Entra Module
        • Module Reference & Getting Started
      • Powershell: Azure Module
        • Installation Instructions
        • Powershell Azure CLI: Windows
        • Powershell Azure CLI: Linux
        • Powershell Azure CLI: MacOS
        • Example Azure Cmdlets
  • Bicep
    • Bicep File Structure
    • Variable Types
  • Azure Logging References
    • Logging
      • Log Retention Strategies
      • Azure Log Types
      • Azure Activity Logs
        • Administrative Event Schema
        • Service Health Notification Schema
        • Resource Health
        • Alert Category
        • Autoscale
        • Security
        • Recommendation
        • Policy
      • Entra ID Logging
        • Identity Based Logs
          • Audit Logs
          • Sign-In Logs
            • AADNonInteractiveUserSignInLogs
            • AADManagedIdentitySignInLogs
            • AADServicePrincipalSignInLogs
            • First Party Sign-In Activity
          • Provisioning Logs (AADProvisioningLogs)
          • Microsoft Graph Activity
          • Identity Protection
            • Risk Detections
            • AADRiskyServicePrincipals
            • AADRiskyUsers
            • AADUserRiskEvents
            • AADServicePrincipalRiskEvents
        • Additional Entra ID Logs
      • Azure Key Vault
        • Azure Key Vault Logging Overview
      • Network Watcher
        • RBAC Permissions
        • Flow Log Types
          • NSG Flow Log Schema
          • VNET Flow Log Schema
        • Enabling Logs
          • NSG Flow Logs
          • VNET Flow Logs
        • Packet Capture
          • Packet Capture: VM
          • Packet Capture: Scale Sets
      • Compute Resources
        • Azure Monitor Agent
        • VM Insights
          • VM Insights Tables
      • Storage Accounts
        • Storage Account Logging
          • File
            • Enable StorageFileLogs
            • StorageFileLogs
          • Blob
            • Enable Blob Logging
            • StorageBlobLogs
          • Queue
            • Enable Queue Logging
            • StorageQueueLogs Table
          • Table
            • Enable Table Logging
            • StorageTableLogs Table
      • Azure App Service
        • Log Types
        • Enabling Logging
      • Azure Monitor
        • Resource Logs
          • Resource Log Top Level Documentation
        • Log Analytics Workspace
          • Setup
        • Workbooks
        • Dashboards
        • Alerts
        • Azure Monitor Documentation
      • Defender for Cloud
      • Intune
      • Sysmon
      • Purview Audit Log Schema
      • Kubernetes Audit Log (AKS)
  • Threat Hunting
    • Threat Hunting in Azure
      • Threat Hunting Introduction
      • Threat Hunting Process
        • Hypothesis Generation
        • Investigation
        • Identification
        • Resolution & Follow Up
      • Pyramid of Pain
      • Azure Threat Hunting Ideas
      • Hands On Threat Hunting Examples
      • OSINT Feeds
  • Sigma
    • Sigma Rule Structure
  • Microsoft Defender TI
    • Microsoft Defender Threat Intelligence
      • Data Sets
      • Reputational Scoring
      • Analyst Insights
      • Microsoft Defender TI: Copilot Integration
  • MITRE Att&ck
    • MITRE Att&ck
      • MITRE Att&ck Concepts
      • MITRE Data Sources
      • MITRE Att&ck Mitigations
      • MITRE Att&ck: Azure
        • MITRE Att&CK: Azure Security Control Mapping
  • Microsoft Resources
    • Microsoft Incident Response Ninja Hub
    • Microsoft Defender XDR Ninja Hub
  • Azure Threat Research Matrix (ATRM)
  • Security Research & Resources
    • Azure Goat
    • Azure Security Research
      • Azure Related CVEs
  • Defender XDR
    • Defender XDR Overview
    • Defender XDR Licensing
    • Defender XDR Default Retention
    • Defender XDR Advanced Hunting Table Schemas
    • Automated Response Requirements
    • Supported Response Actions
  • Azure Sentinel
    • Sentinel Overview
    • Azure Sentinel Deployments
    • Supported Data
    • Workbook, Playbook, Notebook Comparison
    • Sentinel Workbooks
    • Entities
    • User and Entity Behavior Analytics
    • Anomaly Detection
    • Mult-Stage Attack Detection
    • Sentinel: Az CLI
  • Microsoft Defender
    • Microsoft Defender for Cloud References
    • Defender for Cloud: Az CLI
  • Azure Policy
    • Azure Policy
    • Azure Policy Components
    • Azure Policy Rules
    • Scope Azure Policy
    • Policy Assignments
    • Policy Effect
    • Initiative Definition
    • Policy Parameters
    • Remediation Task Structure
    • Use Cases for Azure Policy
    • Azure Policy: Az CLI
  • Intune
    • Intune Overview
    • Intune Licensing
    • Intune API Permission Scopes
    • Intune Sample Script Resources
  • Intune Logging
    • Configure Logging
    • Logging Schema References
    • Intune Queries and Resources
  • Windows Host Security
    • Windows System Architecture and OS Fundamentals
    • SysInternals
    • Basic vs Advanced Security Auditing
    • Sysmon
  • Adversary Emulation
    • AzureHound
    • AADInternals
      • Install
    • RoadTools
      • Install
    • Oh365UserFinder
    • GraphRunner
  • Incident Response
    • Incident Response
      • Azure IR Program Development Cheat Sheet
      • Azure IR Playbooks (MS Guidance)
      • Ransomware (MS Guidance)
  • Automation
    • Automation Overview
    • Logic Apps
      • How Logic Apps Work
      • Logic App Types
      • Triggers
      • Connectors
      • Conditional Logic and Control Flow
      • APIs in Logic Apps
      • Handling Large Workflows with Stateful Logic Apps
      • External Service Integration
      • Securing, Managing, and Scaling Azure Logic Apps
      • Logic Apps: Az CLI
  • Packet Analysis
    • Wireshark Cheatsheet
    • TShark Cheatsheet
    • TCPDUMP Cheatsheet
    • Protocol Analysis Basics
    • HTTP Response Code Cheatsheet
    • RFC Protocol Mappings
    • PCAP Acquisition
  • Detection Lab
    • Detection Lab Introduction
    • Account Creation Instructions
    • Enable MFA Within Azure Tenant
    • Create an Azure Admin With Cloud Shell
    • Setup and Install Instructions
  • VSCode and Code Setup
  • Deploying Code
  • Enabling Logs for Log Analytics Workspace
  • Logging Into Windows VM
  • Verifying Logs in Log Analytics Workspace
  • Creating Detections: Azure Monitor
  • Cost Management: Billing Alarms
Powered by GitBook
On this page
  • Common Use Cases for Azure Policy in Threat Hunting
  • 1. Enforcing Encryption on Sensitive Data
  • 2. Auditing Public IPs on Virtual Machines
  • 3. Enforcing Multi-Factor Authentication (MFA) for Administrative Accounts
  • 4. Requiring Network Security Groups (NSGs) on Virtual Machines
  • 5. Ensuring Diagnostic Logs are Enabled
  • 6. Controlling Resource Locations
  • 7. Auditing and Denying Deprecated Services
  1. Azure Policy

Use Cases for Azure Policy

Common Use Cases for Azure Policy in Threat Hunting

Azure Policy plays a critical role in ensuring the security of your cloud environment by automatically detecting and addressing misconfigurations or violations of security controls. For threat hunters, Azure Policy provides both preventive and detective capabilities that reduce the attack surface and help monitor for potential threats. Let’s explore some common use cases that are directly relevant to threat hunters.

Whether or not certain activity is blocked or audited will depend on the risk appetite of the business and is unique to each organization. It is always highly recommended and encouraged to follow standard security best practices.

1. Enforcing Encryption on Sensitive Data

Use Case: Ensuring that all sensitive data stored in Azure, such as in Azure Storage Accounts or Azure SQL Databases, is encrypted to prevent unauthorized access if data is breached or accessed maliciously.

How Azure Policy Helps:

  • You can create or assign a policy that enforces encryption at rest on all storage resources. The policy audits storage accounts, databases, or other resources and flags any that do not have encryption enabled.

  • Example Policy: “Ensure encryption is enabled on all storage accounts.” This policy could deny the creation of unencrypted storage accounts, ensuring that sensitive data is always stored securely.

2. Auditing Public IPs on Virtual Machines

Use Case: Public IP addresses on virtual machines expose them to the internet, increasing the risk of brute force attacks, DDoS attacks, and unauthorized access. As a threat hunter, you want to audit and restrict the use of public IP addresses to minimize the attack surface.

How Azure Policy Helps:

  • Azure Policy can audit and even deny the creation of VMs with public IP addresses unless explicitly allowed. You can create a policy that automatically flags or blocks VMs that are deployed with a public IP, ensuring that only specific machines have external exposure.

  • Example Policy: “Audit VMs with public IP addresses.” This policy audits any VM with a public IP and logs non-compliant resources. You can review these logs to investigate potential risks or enforce tighter controls by switching to a Deny effect.

Threat Hunting Advantage: Using the audit data, threat hunters can monitor the exposure of VMs to the internet and detect patterns of potential unauthorized access or attempts to exploit publicly exposed resources.

3. Enforcing Multi-Factor Authentication (MFA) for Administrative Accounts

Use Case: Protecting administrative accounts is crucial since compromised privileged accounts can lead to complete control of your environment. Threat hunters need to ensure that all administrative accounts use Multi-Factor Authentication (MFA) to prevent unauthorized access, even if passwords are compromised.

How Azure Policy Helps:

  • You can create an Azure Policy that ensures MFA is enabled for all administrative accounts within Azure Active Directory (AAD). The policy can audit accounts that lack MFA and log them for further investigation, or automatically enforce MFA.

  • Example Policy: “Audit Azure AD users without MFA enabled.” This policy checks administrative accounts and flags any that don’t have MFA enabled.

Threat Hunting Advantage: By auditing accounts without MFA, you can immediately detect potential security gaps and take action to secure these high-risk accounts before they are exploited by attackers.

4. Requiring Network Security Groups (NSGs) on Virtual Machines

Use Case: Network Security Groups (NSGs) are essential for controlling inbound and outbound traffic to virtual machines. Without proper NSG configurations, VMs can be exposed to unauthorized access or malicious network traffic. Threat hunters need to ensure that every VM is protected by NSGs.

How Azure Policy Helps:

  • Azure Policy can enforce the use of NSGs on all virtual machines by auditing VMs that don’t have an NSG attached or by denying the creation of VMs without NSGs.

  • Example Policy: “Deny the creation of VMs without a Network Security Group (NSG).” This policy ensures that all VMs have proper traffic controls in place, reducing the risk of unauthorized access or data exfiltration.

Threat Hunting Advantage: Using Azure Policy to enforce NSGs simplifies your ability to detect misconfigurations and close potential attack vectors, ensuring that traffic to and from VMs is always controlled and monitored.

5. Ensuring Diagnostic Logs are Enabled

Use Case: As a threat hunter, having access to diagnostic logs is crucial for identifying and investigating potential threats. You want to ensure that all Azure resources (e.g., VMs, storage accounts, databases) have diagnostic logging enabled to capture critical security events.

How Azure Policy Helps:

  • Azure Policy can be used to ensure that diagnostic logs are always enabled on resources. If logging is disabled on any resource, the policy will flag the issue and can automatically enable the logging settings.

  • Example Policy: “Ensure diagnostic logs are enabled for all VMs.” This policy ensures that all VM activity is logged, providing essential data for threat hunting and forensic investigations.

Threat Hunting Advantage: Diagnostic logs give you visibility into resource activities, helping you detect anomalies, investigate incidents, and track potential threats across your environment. By ensuring logs are always enabled, you never miss critical security data.

6. Controlling Resource Locations

Use Case: To comply with organizational security standards or regulatory requirements, some data must be stored in specific geographic regions (e.g., within the EU for GDPR compliance). As a threat hunter, you want to ensure that resources are only deployed in approved regions to avoid data exposure to unauthorized jurisdictions.

How Azure Policy Helps:

  • You can create a policy that restricts resource creation to specific regions. For example, the policy could deny the creation of any resource outside of the EU or the organization's approved regions.

  • Example Policy: “Restrict resource creation to specific geographic regions.” This policy ensures that resources are always deployed in approved locations, reducing compliance risks.

Threat Hunting Advantage: By restricting resource locations, you minimize the risk of sensitive data being accessed or stored in unauthorized locations, reducing the chance of regulatory violations or data exposure in high-risk regions.

7. Auditing and Denying Deprecated Services

Use Case: Over time, certain Azure services may become deprecated or obsolete. Using deprecated services can expose your environment to security vulnerabilities as they are no longer updated with security patches. Threat hunters must ensure that deprecated services are not used in the environment.

How Azure Policy Helps:

  • Azure Policy can audit and deny the usage of deprecated or unsupported services, ensuring that all resources comply with the latest security and performance standards.

  • Example Policy: “Audit deprecated services.” This policy flags any use of deprecated services, allowing you to investigate and decommission them as needed.

Threat Hunting Advantage: Ensuring that only supported services are used reduces the risk of unpatched vulnerabilities, helping you maintain a secure and up-to-date cloud environment.

Last updated 8 months ago