📘
DFIR
Ctrlk
  • Networking
    • Networking
  • Windows
    • Administration
    • Forensics
    • Cheat Sheet
    • Investigation
    • Internals
    • Active Directory
    • MISC
  • Linux
    • Forensics
    • SSH
    • Linux WebShells
    • Directories of Interest
    • Internals
  • Enterprise Architecture
    • CI/CD Pipline
    • Citrix
    • Web Applications
    • The Cloud
      • AWS
      • Azure
        • Hunting
        • Admin
        • Securing Azure
        • CheatSheet
        • Detections
        • Forensics
        • Attacking Azure
          • Initial Access
          • Persistence
            • Cloud VMs
            • Applications
            • SSPR/MFA
            • Automation Account
            • Identity Federation
            • Service Principals
            • Tokens
            • Cross Tenant Synchronization
            • Golden SAML
            • Conditional Access Policies
            • User Creation
          • Credential Theft
          • Execution
          • Exfiltration
          • Test Page
        • Fundementals
        • Logging
      • M365
      • Cloud Labs
    • vSphere
    • Containers
    • Troubleshooting
  • Mac
    • Forensics
  • Attacker Information
    • Adversary Operations
    • Actor Playbooks
    • Abused Domains
  • IR Playbook
    • Activity from Unmanaged Host
    • Recommendations
  • Reverse Engineering
    • Python - Pyinstaller
Powered by GitBook
On this page
  • What Is BLANK
  • Attack
  • Detect
  • What logs are available?
  • Mitigate
  1. Enterprise Architecture
  2. The Cloud
  3. Azure
  4. Attacking Azure
  5. Persistence

User Creation

What Is BLANK

Attack

Detect

What logs are available?

Mitigate

PreviousConditional Access PoliciesNextCredential Theft

Last updated 1 month ago