☁️
CTHFM: Azure
  • Welcome
  • Getting Started
    • Account Setup
      • Account Creation Instructions
  • Azure Fundamentals
    • Azure Fundamentals Overview
      • Azure Documentation
      • Azure Entra
      • Azure Hierarchy
      • Identities
      • Azure Entra Roles
      • Azure RBAC
      • Azure Licensing Overview
        • Azure Entra ID Premium Licenses Comparison
      • Azure Shared Responsibility Model
      • Azure Frameworks
      • Azure Security Services
      • Conditional Access Policies
        • How Conditional Access Policies Work
        • Benefits of Conditional Access
        • Best Practices for Conditional Access
        • Conditions for Conditional Access
        • Conditional Access Controls
        • Sign-In Risk and Identity Protection
        • Conditional Access Session Control
        • Name Locations IP Location
      • Azure Quotas
      • Azure Tokens
        • Access Tokens
        • ID Tokens
        • Refresh Tokens
          • Invalidate Refresh Tokens
        • Primary Refresh Tokens
        • Continuous Access Evaluation (CAE)
        • Token Protection: Conditional Access (Public Preview)
  • Azure CLI
    • Introduction to Azure CLI
    • Installing Azure CLI
    • CLI Commands
    • Resource Group Management
    • Creating and Managing Resources with Azure CLI
    • Managing IAM
    • Azure CLI Automation
    • Monitoring and Troubleshooting in Azure CLI
    • Azure CLI Overview
      • Azure CLI: Linux
      • Azure CLI: Windows
      • Azure CLI: MacOS
  • KQL
    • KQL Overview
      • KQL Introduction
      • Data Types
      • Quick Reference
      • Render
      • Basic Queries
  • Powershell
    • PowerShell for Azure
      • Powershell Documentation
      • Powershell Basics
      • Understanding Powershell Variables
      • Understanding Cmdlets
      • Powershell Console & ISE
      • Powershell: Entra Module
        • Module Reference & Getting Started
      • Powershell: Azure Module
        • Installation Instructions
        • Powershell Azure CLI: Windows
        • Powershell Azure CLI: Linux
        • Powershell Azure CLI: MacOS
        • Example Azure Cmdlets
  • Bicep
    • Bicep File Structure
    • Variable Types
  • Azure Logging References
    • Logging
      • Log Retention Strategies
      • Azure Log Types
      • Azure Activity Logs
        • Administrative Event Schema
        • Service Health Notification Schema
        • Resource Health
        • Alert Category
        • Autoscale
        • Security
        • Recommendation
        • Policy
      • Entra ID Logging
        • Identity Based Logs
          • Audit Logs
          • Sign-In Logs
            • AADNonInteractiveUserSignInLogs
            • AADManagedIdentitySignInLogs
            • AADServicePrincipalSignInLogs
            • First Party Sign-In Activity
          • Provisioning Logs (AADProvisioningLogs)
          • Microsoft Graph Activity
          • Identity Protection
            • Risk Detections
            • AADRiskyServicePrincipals
            • AADRiskyUsers
            • AADUserRiskEvents
            • AADServicePrincipalRiskEvents
        • Additional Entra ID Logs
      • Azure Key Vault
        • Azure Key Vault Logging Overview
      • Network Watcher
        • RBAC Permissions
        • Flow Log Types
          • NSG Flow Log Schema
          • VNET Flow Log Schema
        • Enabling Logs
          • NSG Flow Logs
          • VNET Flow Logs
        • Packet Capture
          • Packet Capture: VM
          • Packet Capture: Scale Sets
      • Compute Resources
        • Azure Monitor Agent
        • VM Insights
          • VM Insights Tables
      • Storage Accounts
        • Storage Account Logging
          • File
            • Enable StorageFileLogs
            • StorageFileLogs
          • Blob
            • Enable Blob Logging
            • StorageBlobLogs
          • Queue
            • Enable Queue Logging
            • StorageQueueLogs Table
          • Table
            • Enable Table Logging
            • StorageTableLogs Table
      • Azure App Service
        • Log Types
        • Enabling Logging
      • Azure Monitor
        • Resource Logs
          • Resource Log Top Level Documentation
        • Log Analytics Workspace
          • Setup
        • Workbooks
        • Dashboards
        • Alerts
        • Azure Monitor Documentation
      • Defender for Cloud
      • Intune
      • Sysmon
      • Purview Audit Log Schema
      • Kubernetes Audit Log (AKS)
  • Threat Hunting
    • Threat Hunting in Azure
      • Threat Hunting Introduction
      • Threat Hunting Process
        • Hypothesis Generation
        • Investigation
        • Identification
        • Resolution & Follow Up
      • Pyramid of Pain
      • Azure Threat Hunting Ideas
      • Hands On Threat Hunting Examples
      • OSINT Feeds
  • Sigma
    • Sigma Rule Structure
  • Microsoft Defender TI
    • Microsoft Defender Threat Intelligence
      • Data Sets
      • Reputational Scoring
      • Analyst Insights
      • Microsoft Defender TI: Copilot Integration
  • MITRE Att&ck
    • MITRE Att&ck
      • MITRE Att&ck Concepts
      • MITRE Data Sources
      • MITRE Att&ck Mitigations
      • MITRE Att&ck: Azure
        • MITRE Att&CK: Azure Security Control Mapping
  • Microsoft Resources
    • Microsoft Incident Response Ninja Hub
    • Microsoft Defender XDR Ninja Hub
  • Azure Threat Research Matrix (ATRM)
  • Security Research & Resources
    • Azure Goat
    • Azure Security Research
      • Azure Related CVEs
  • Defender XDR
    • Defender XDR Overview
    • Defender XDR Licensing
    • Defender XDR Default Retention
    • Defender XDR Advanced Hunting Table Schemas
    • Automated Response Requirements
    • Supported Response Actions
  • Azure Sentinel
    • Sentinel Overview
    • Azure Sentinel Deployments
    • Supported Data
    • Workbook, Playbook, Notebook Comparison
    • Sentinel Workbooks
    • Entities
    • User and Entity Behavior Analytics
    • Anomaly Detection
    • Mult-Stage Attack Detection
    • Sentinel: Az CLI
  • Microsoft Defender
    • Microsoft Defender for Cloud References
    • Defender for Cloud: Az CLI
  • Azure Policy
    • Azure Policy
    • Azure Policy Components
    • Azure Policy Rules
    • Scope Azure Policy
    • Policy Assignments
    • Policy Effect
    • Initiative Definition
    • Policy Parameters
    • Remediation Task Structure
    • Use Cases for Azure Policy
    • Azure Policy: Az CLI
  • Intune
    • Intune Overview
    • Intune Licensing
    • Intune API Permission Scopes
    • Intune Sample Script Resources
  • Intune Logging
    • Configure Logging
    • Logging Schema References
    • Intune Queries and Resources
  • Windows Host Security
    • Windows System Architecture and OS Fundamentals
    • SysInternals
    • Basic vs Advanced Security Auditing
    • Sysmon
  • Adversary Emulation
    • AzureHound
    • AADInternals
      • Install
    • RoadTools
      • Install
    • Oh365UserFinder
    • GraphRunner
  • Incident Response
    • Incident Response
      • Azure IR Program Development Cheat Sheet
      • Azure IR Playbooks (MS Guidance)
      • Ransomware (MS Guidance)
  • Automation
    • Automation Overview
    • Logic Apps
      • How Logic Apps Work
      • Logic App Types
      • Triggers
      • Connectors
      • Conditional Logic and Control Flow
      • APIs in Logic Apps
      • Handling Large Workflows with Stateful Logic Apps
      • External Service Integration
      • Securing, Managing, and Scaling Azure Logic Apps
      • Logic Apps: Az CLI
  • Packet Analysis
    • Wireshark Cheatsheet
    • TShark Cheatsheet
    • TCPDUMP Cheatsheet
    • Protocol Analysis Basics
    • HTTP Response Code Cheatsheet
    • RFC Protocol Mappings
    • PCAP Acquisition
  • Detection Lab
    • Detection Lab Introduction
    • Account Creation Instructions
    • Enable MFA Within Azure Tenant
    • Create an Azure Admin With Cloud Shell
    • Setup and Install Instructions
  • VSCode and Code Setup
  • Deploying Code
  • Enabling Logs for Log Analytics Workspace
  • Logging Into Windows VM
  • Verifying Logs in Log Analytics Workspace
  • Creating Detections: Azure Monitor
  • Cost Management: Billing Alarms
Powered by GitBook
On this page
  • Initial Access Techniques in Entra ID (Azure Identity Environments)
  • πŸ“Š Initial Access Techniques in Entra ID (MITRE Mapped)
  • 🎯 Final Summary
  1. MITRE Att&ck
  2. Azure MITRE Frameworks
  3. Identity Provider Matrix (Entra ID)

Initial Access: TA0001

Initial Access Techniques in Entra ID (Azure Identity Environments)

In Microsoft Entra ID (Azure Active Directory), adversaries use Initial Access techniques to gain a foothold into the cloud identity plane. This includes phishing users, abusing trusted federations (B2B collaboration, cross-tenant access), or exploiting weak/default cloud identities.

Identity is the entry point for most cloud breaches β€” protecting Entra ID is your first line of defense.


🎯 Drive-by Compromise

| MITRE ID | T1189 |

Description: An adversary compromises a user’s device by tricking them into visiting a malicious website that silently exploits vulnerabilities or drops malware (e.g., token stealers, session hijackers).

Entra ID Example:

  • Victim visits a malicious site that injects a rogue OAuth application consent prompt ("Consent phishing").

  • The user unknowingly grants the malicious app access to their Microsoft 365 or Azure resources.

bashCopyEdit# Rogue app request
https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=<malicious-app-id>&response_type=code&scope=openid+profile+user.read+mail.read

βœ… Result: Adversary gains OAuth token access to Entra ID-protected resources without needing credentials.


🎣 Phishing


➑️ Spearphishing Link

| MITRE ID | T1566.002 |

Description: Send a targeted email containing a malicious link that steals Entra ID credentials, MFA codes, or session cookies when clicked.

Entra ID Example:

  • Victim receives a phishing email mimicking Microsoft login.

  • Link redirects to an Azure-like phishing page (login.microsoftonline.com.fake.site) capturing credentials.

βœ… Result: Adversary harvests credentials and possibly MFA tokens, gaining Entra ID access.


➑️ Spearphishing Voice (Vishing)

| MITRE ID | T1566.004 |

Description: Call targeted users pretending to be Microsoft support or IT helpdesk and trick them into revealing credentials, MFA codes, or approving MFA push notifications.

Entra ID Example:

  • Victim receives a call instructing them to "verify" their MFA code or approve an MFA prompt.

  • Attacker simultaneously attempts login and tricks victim into approving.

βœ… Result: Adversary bypasses MFA and gains account access.


πŸ”— Trusted Relationship

| MITRE ID | T1199 |

Description: Abuse federated identities, cross-tenant B2B access, or delegated admin privileges to gain access to Entra ID resources.

Entra ID Example:

  • Attacker compromises an account from a trusted external tenant (Azure B2B collaboration).

  • Uses trust relationship to access internal Entra ID groups, apps, or resources.

bashCopyEdit# External user login
az login --username compromised_user@trustedtenant.com
az ad user list

βœ… Result: Access internal resources without needing direct exploitation.


πŸ‘€ Valid Accounts


➑️ Default Accounts

| MITRE ID | T1078.004 |

Description: Abuse default service principals, automation accounts, managed identities, or misconfigured guest accounts in Entra ID.

Entra ID Example:

  • An attacker finds a default Entra ID guest account that still has "Contributor" role assigned in Azure subscriptions.

βœ… Result: Immediate access using poorly configured identities.


➑️ Cloud Accounts

| MITRE ID | T1078.004 |

Description: Use stolen or leaked Entra ID cloud user accounts (standard users, admins, service principals) to authenticate directly.

Entra ID Example:

  • Attacker phishes a standard Entra ID user or recovers leaked Office 365 credentials.

  • Logs into Azure and enumerates environment.

bashCopyEditaz login --username phisheduser@victimdomain.com

βœ… Result: Legitimate-looking session inside Entra ID and Azure.


πŸ“Š Initial Access Techniques in Entra ID (MITRE Mapped)

Technique/Subtechnique
MITRE ID
Entra ID Example

Drive-by Compromise

T1189

OAuth app consent phishing via rogue site

Spearphishing Link

T1566.002

Email phishing with Azure login clone

Spearphishing Voice (Vishing)

T1566.004

Fake IT support call to capture MFA code

Trusted Relationship

T1199

Abuse external Azure AD B2B tenant trust

Default Accounts

T1078.004

Misconfigured guest/service principal usage

Cloud Accounts

T1078.004

Use stolen cloud user or service principal credentials


🎯 Final Summary

Defending against Initial Access in Entra ID focuses on:

  • Hardening user authentication flows (MFA, CA policies, phishing-resistant auth)

  • Securing and monitoring trusted relationships

  • Reducing the blast radius of default, guest, and service principal accounts

  • Detecting credential phishing attempts early

Last updated 1 month ago