📘
DFIR
Ctrlk
  • Networking
    • Networking
  • Windows
    • Administration
    • Forensics
    • Cheat Sheet
    • Investigation
    • Internals
    • Active Directory
    • MISC
  • Linux
    • Forensics
    • SSH
    • Linux WebShells
    • Directories of Interest
    • Internals
  • Enterprise Architecture
    • CI/CD Pipline
    • Citrix
    • Web Applications
    • The Cloud
      • AWS
      • Azure
        • Hunting
        • Admin
        • Securing Azure
        • CheatSheet
        • Detections
        • Forensics
        • Attacking Azure
          • Initial Access
          • Persistence
            • Cloud VMs
            • Applications
            • SSPR/MFA
            • Automation Account
            • Identity Federation
            • Service Principals
            • Tokens
            • Cross Tenant Synchronization
            • Golden SAML
            • Conditional Access Policies
            • User Creation
          • Credential Theft
          • Execution
          • Exfiltration
          • Test Page
        • Fundementals
        • Logging
      • M365
      • Cloud Labs
    • vSphere
    • Containers
    • Troubleshooting
  • Mac
    • Forensics
  • Attacker Information
    • Adversary Operations
    • Actor Playbooks
    • Abused Domains
  • IR Playbook
    • Activity from Unmanaged Host
    • Recommendations
  • Reverse Engineering
    • Python - Pyinstaller
Powered by GitBook
On this page
  • What Is BLANK
  • Attack
  • Detect
  • What logs are available?
  • Mitigate
  1. Enterprise Architecture
  2. The Cloud
  3. Azure
  4. Attacking Azure
  5. Persistence

Automation Account

LogoHow to Detect Malicious Azure Persistence Through Automation Account Abusewww.inversecos.com

What Is BLANK

Attack

Detect

What logs are available?

Mitigate

PreviousSSPR/MFANextIdentity Federation

Last updated 1 month ago