How to response in Azure?

Azure standard architecture and concepts

Computer forensics Chain of Custody in Azure - Azure Example Scenarios

Digital forensics is a science that addresses the recovery and investigation of digital data to support criminal investigations or civil proceedings. Computer forensics is a branch of digital forensics that captures and analyzes data from computers, virtual machines (VMs), and digital storage media.

docs.microsoft.com

Azure AD introduction for red teamers

Azure AD serves as an identity management platform for Microsoft Applications, Azure Resources Manager and basically anything else you integrate it with. Source: https://docs.microsoft.com/en-gb/azure/active-directory/manage-apps/what-is-application-management. Despite the misleading name, Azure AD is not Active Directory in the cloud. However, a parallel between the two solutions can be established: Source: https://troopers.de/downloads/troopers19/TROOPERS19_AD_Im_in_your_cloud.pdf There are many ways to interact with Azure AD: The Azure Portal.

www.synacktiv.com

Be familiar with Azure products

Become a Microsoft Defender ATP Ninja

Do you want to become a ninja for Microsoft Defender ATP? We can help you get there! We collected content for two roles: "Security Operations (SecOps)" and "Security Administrator (SecAdmin)". The content is structured into three different knowledge levels, with multiple modules: Fundamentals, Inter...

techcommunity.microsoft.com

A Blue Team guide to Azure & Office 365 monitoring

A few weeks ago I thought that 0x00sec didn't have enough Blue Team focused posts. Yet, detection of potential threats is incredibly important in any organization. Because Azure and Office 365 are widely used, I decided to start with this.

0x00sec.org

Microsoft 365 Security

All the latest security features about Microsoft 365

m365internals.com

Collecting and analyzing Azure logs

Incident Response Series: Collecting and analyzing logs in azure ad

Today, I'm going to start my incident response series. Where I will focus on Azure Active Directory and Office 365. What are the steps, that we have to take when doing an IR engagement in a Cloud environment? Incident Response is a broad topic and it's hard to cover every specific detail, so I've decided...

m365internals.com

Collecting O365 and Azure AD logs

Disk acquisition in Azure

Forensic Disk Copies in Azure

In a previous blog post , we presented how libcloudforensics facilitates digital forensics investigation in the cloud, in particular we focused on disk copy functionality in Google Cloud Platform (GCP) and Amazon Web Services (AWS). We recently added support for Microsoft Azure.

osdfir.blogspot.com

Attacks scenarios on Azure AD

Community Project: Azure AD Attack and Defense Playbook

In the recent weeks, I've worked together with Sami Lamppu on the first section of a playbook about common attack and defense scenarios in Azure AD. In this article I would like to talk about the motivation, objective of the document and invite everyone from the community to participate in this project.

www.cloud-architekt.net