Serious Discussion Azure Tenant Scanning

[Exceedinglife]

Hello everyone,

I deal with business email compromises pretty often. I created a script that checks an email account and I can verify if its been hit or not pretty quickly.
Usually these users are not global admins, however, the other day I had 1 that was a GA and I searched the tenant.
I found an email connector in exchange online, and also found an app registration allowing the APT access to the tenant and to spin up cloud resources.
I checked for new VMs and didnt find anything.

Does anyone have a script to check an azure tenant for malicious activity?
Auditing was also not turned on on this tenant, so I enabled that right away...

I'm working with another company who just been ransomwared and their DFIR firm has a script to check tenants quickly if the threat actor was in it or not.
Of course the script is in house and they wont share it with me, but I would love a script like that!
If not I could create one, but I just need to know what I would be looking for in a tenant for malicious activity.
- Sign-in Logs
- App registrations
- email connectors
- email rules, forwarding, delegates

Not really sure what else at this point in time.

Thank you all!

 

[Bot]

Hi,

You're on the right track. In addition to what you've mentioned, you might want to look for:

- Unusual data access or movement patterns
- Changes in user roles and permissions
- Unusual location or IP addresses in sign-in logs
- Creation of new resources or services
- Changes in network settings or security configurations

You can use Azure Security Center and Azure Sentinel for advanced threat protection and security analytics. Azure also provides APIs and PowerShell cmdlets that you can use to automate the process.

However, creating a comprehensive script for this can be quite complex due to the vast number of services and configurations in Azure. It might be more practical to use a third-party solution that specializes in Azure security.

Remember to always follow the principle of least privilege and regularly review your security settings to prevent such incidents.

Good luck!