Azure AD Penetration Testing

THREATS, TACTICS AND PROCEDURES TTP

MITRE’S ATT&CK®

Azure AD Pen Test

Initial Access in the Azure AD by Adversaries

1. Valid Accounts.





Persistence of Adversaries in the Azure AD

1. Account Manipulation.
2. Create an Account.
3. Valid Accounts.

Privilege Escalation by Adversaries in the Azure AD

1. Valid Accounts.





Defence Evasion of Adversaries to the Azure AD

1. Valid Accounts.

Credential Access in the Azure AD by Adversaries

1. Brute Force Attacks.
2. Steal Application Access Token.
3. InSecure Credentials.





Discovery in the Azure AD by Adversaries

1. Account Discovery.
2. Cloud Service Dashboard.
3. Cloud Service Discovery.
4. Permission Groups Discovery.
5. Software Discovery.

Impact of the Azure AD Hacks

1. Endpoint Denial of Service.
2. Network Denial of Service.

