Lab description
This lab contains 13 Azure resource(s), 45 assignment(s), and 7 enabled attack path(s).
Organization
The organization contains 12 user(s), 5 group(s), 10 service principal(s), and 0 administrative unit(s).
Identity Plane
12Users
5Groups
10Service principals
0Administrative units
45Assignments
Users (12)
| Object | Properties |
|---|---|
| ulysses.dute |
display name: Ulysses Dute mail nickname: ulysses.dute user principal name: ulysses.dute |
| leopoldo.hilfiker |
display name: Leopoldo Hilfiker mail nickname: leopoldo.hilfiker user principal name: leopoldo.hilfiker |
| miguel.bemrose |
display name: Miguel Bemrose mail nickname: miguel.bemrose user principal name: miguel.bemrose |
| destiny.girand |
display name: Destiny Girand mail nickname: destiny.girand user principal name: destiny.girand |
| trent.darjean |
display name: Trent Darjean mail nickname: trent.darjean user principal name: trent.darjean |
| ernie.singleton |
display name: Ernie Singleton mail nickname: ernie.singleton user principal name: ernie.singleton |
| katelyn.subich |
display name: Katelyn Subich mail nickname: katelyn.subich user principal name: katelyn.subich |
| addie.goheen |
display name: Addie Goheen mail nickname: addie.goheen user principal name: addie.goheen |
| geraldine.dilworth |
display name: Geraldine Dilworth mail nickname: geraldine.dilworth user principal name: geraldine.dilworth |
| freddy.zindel |
display name: Freddy Zindel mail nickname: freddy.zindel user principal name: freddy.zindel |
| clarice.kaminsky |
display name: Clarice Kaminsky mail nickname: clarice.kaminsky user principal name: clarice.kaminsky |
| bryan.ohanesian |
display name: Bryan Ohanesian mail nickname: bryan.ohanesian user principal name: bryan.ohanesian |
Groups (5)
| Object | Properties |
|---|---|
| Data Strategy | display name: Data Strategy |
| Product Support | display name: Product Support |
| Performance Management | display name: Performance Management |
| Cloud Security | display name: Cloud Security |
| IT Governance | display name: IT Governance |
Applications (10)
| Object | Properties |
|---|---|
| OmniBuilder | display name: OmniBuilder |
| WebEngineSky | display name: WebEngineSky |
| FuturePulse | display name: FuturePulse |
| DynamicOperatorPro | display name: DynamicOperatorPro |
| BetaResponder | display name: BetaResponder |
| GeoBuilder | display name: GeoBuilder |
| SonicForgeBlast | display name: SonicForgeBlast |
| NanoStream | display name: NanoStream |
| CodeMover | display name: CodeMover |
| WebInnovator | display name: WebInnovator |
Administrative Units (0)
None
Assignments(45)
| Type | Source | Target | Properties |
|---|---|---|---|
| OWNS_APPLICATION | katelyn.subich | NanoStream |
key: app_ownership-gafxhu_app_owner origin: attack_path |
| ASSIGNED_ENTRA_ROLE | NanoStream | Global Administrator |
key: app_ownership-gafxhu_app_role_0 origin: attack_path role: Global Administrator |
| ASSIGNED_ENTRA_ROLE | bryan.ohanesian | Application Administrator |
key: app_admin-1aecfk_admin_role origin: attack_path role: Application Administrator |
| ASSIGNED_ENTRA_ROLE | BetaResponder | Global Administrator |
key: app_admin-1aecfk_app_role_0 origin: attack_path role: Global Administrator |
| ASSIGNED_ENTRA_ROLE | addie.goheen | Cloud Application Administrator |
key: cloud_app_admin-k6tlat_admin_role origin: attack_path role: Cloud Application Administrator |
| ASSIGNED_ENTRA_ROLE | DynamicOperatorPro | Global Administrator |
key: cloud_app_admin-k6tlat_app_role_0 origin: attack_path role: Global Administrator |
| ASSIGNED_AZURE_ROLE | trent.darjean | Infra-Bkp-01-lz |
key: mi_abuse-7qhab0_src_contrib origin: attack_path role: Virtual Machine Contributor scope type: resource scope ref: Infra-Bkp-01-lz |
| ASSIGNED_AZURE_ROLE | Infra-Bkp-01-lz | Prod-Shared-Vaultfdfj |
key: mi_abuse-7qhab0_mi_kv_0 origin: attack_path role: Key Vault Contributor scope type: resource scope ref: Prod-Shared-Vaultfdfj |
| ASSIGNED_AZURE_ROLE | Infra-Bkp-01-lz | Prod-Shared-Vaultfdfj |
key: mi_abuse-7qhab0_mi_kv_1 origin: attack_path role: Key Vault Secrets User scope type: resource scope ref: Prod-Shared-Vaultfdfj |
| ASSIGNED_AZURE_ROLE | Infra-Bkp-01-lz | Prod-Shared-Vaultfdfj |
key: mi_abuse-7qhab0_mi_kv_2 origin: attack_path role: Key Vault Reader scope type: resource scope ref: Prod-Shared-Vaultfdfj |
| ASSIGNED_ENTRA_ROLE | OmniBuilder | Global Administrator |
key: mi_abuse-7qhab0_app_role_0 origin: attack_path role: Global Administrator |
| ASSIGNED_AZURE_ROLE | miguel.bemrose | IT-Secrets-Vaultxt8e |
key: kv_theft-tbj5k4_kv_access origin: attack_path role: Key Vault Contributor scope type: resource scope ref: IT-Secrets-Vaultxt8e |
| ASSIGNED_ENTRA_ROLE | GeoBuilder | Global Administrator |
key: kv_theft-tbj5k4_app_role_0 origin: attack_path role: Global Administrator |
| ASSIGNED_AZURE_ROLE | trent.darjean | InfraAutomationSA3q5 |
key: storage_theft-hbtegr_sa_access origin: attack_path role: Storage Blob Data Reader scope type: resource scope ref: InfraAutomationSA3q5 |
| ASSIGNED_ENTRA_ROLE | FuturePulse | Global Administrator |
key: storage_theft-hbtegr_app_role_0 origin: attack_path role: Global Administrator |
| ASSIGNED_AZURE_ROLE | bryan.ohanesian | cosmos-catalog-zkjp |
key: cosmos_theft-uaix3z_cosmos_access origin: attack_path role: 00000000-0000-0000-0000-000000000002 scope type: resource scope ref: cosmos-catalog-zkjp data plane: cosmos_sql |
| ASSIGNED_ENTRA_ROLE | WebEngineSky | Global Administrator |
key: cosmos_theft-uaix3z_app_role_0 origin: attack_path role: Global Administrator |
| ASSIGNED_AZURE_ROLE | katelyn.subich | Subscription |
key: recon_reader_katelyn.subich origin: attack_path role: Reader scope type: subscription |
| ASSIGNED_AZURE_ROLE | bryan.ohanesian | Subscription |
key: recon_reader_bryan.ohanesian origin: attack_path role: Reader scope type: subscription |
| ASSIGNED_AZURE_ROLE | addie.goheen | Subscription |
key: recon_reader_addie.goheen origin: attack_path role: Reader scope type: subscription |
| ASSIGNED_AZURE_ROLE | trent.darjean | Subscription |
key: recon_reader_trent.darjean origin: attack_path role: Reader scope type: subscription |
| ASSIGNED_AZURE_ROLE | miguel.bemrose | Subscription |
key: recon_reader_miguel.bemrose origin: attack_path role: Reader scope type: subscription |
| MEMBER_OF | leopoldo.hilfiker | IT Governance |
key: baseline_grpmem_0 origin: random |
| MEMBER_OF | ulysses.dute | Cloud Security |
key: baseline_grpmem_1 origin: random |
| MEMBER_OF | geraldine.dilworth | Cloud Security |
key: baseline_grpmem_2 origin: random |
| MEMBER_OF | geraldine.dilworth | IT Governance |
key: baseline_grpmem_3 origin: random |
| MEMBER_OF | leopoldo.hilfiker | Product Support |
key: baseline_grpmem_4 origin: random |
| MEMBER_OF | ulysses.dute | Product Support |
key: baseline_grpmem_5 origin: random |
| ASSIGNED_ENTRA_ROLE | FuturePulse | Attribute Definition Administrator |
key: baseline_entra_0 origin: random role: Attribute Definition Administrator |
| ASSIGNED_ENTRA_ROLE | WebEngineSky | Identity Governance Administrator |
key: baseline_entra_1 origin: random role: Identity Governance Administrator |
| ASSIGNED_ENTRA_ROLE | trent.darjean | Attribute Definition Administrator |
key: baseline_entra_2 origin: random role: Attribute Definition Administrator |
| ASSIGNED_ENTRA_ROLE | destiny.girand | Virtual Visits Administrator |
key: baseline_entra_3 origin: random role: Virtual Visits Administrator |
| GRANTED_API_PERMISSION | WebEngineSky | Microsoft Graph |
key: baseline_api_0 origin: random permission: NetworkAccessBranch.ReadWrite.All permission id: 8137102d-ec16-4191-aaf8-7aeda8026183 api type: graph |
| GRANTED_API_PERMISSION | CodeMover | Microsoft Graph |
key: baseline_api_1 origin: random permission: Directory.ReadWrite.All permission id: 19dbc75e-c2e2-444c-a770-ec69d8559fc7 api type: graph |
| GRANTED_API_PERMISSION | OmniBuilder | Microsoft Graph |
key: baseline_api_2 origin: random permission: DeviceManagementRBAC.Read.All permission id: 58ca0d9a-1575-47e1-a3cb-007ef2e4583b api type: graph |
| GRANTED_API_PERMISSION | BetaResponder | Microsoft Graph |
key: baseline_api_3 origin: random permission: Group.ReadWrite.All permission id: 62a82d76-70ea-41e2-9197-370581804d09 api type: graph |
| ASSIGNED_AZURE_ROLE | destiny.girand | IT-Secrets-Vaultxt8e |
key: baseline_rbac_0 origin: random role: Web Plan Contributor scope type: resource scope ref: IT-Secrets-Vaultxt8e |
| ASSIGNED_AZURE_ROLE | miguel.bemrose | Networking-Infra-RG |
key: baseline_rbac_1 origin: random role: Virtual Machine Administrator Login scope type: resource_group scope ref: Networking-Infra-RG |
| ASSIGNED_AZURE_ROLE | DynamicOperatorPro | cosmos-catalog-zkjp |
key: baseline_rbac_2 origin: random role: Storage Blob Data Owner scope type: resource scope ref: cosmos-catalog-zkjp |
| ASSIGNED_AZURE_ROLE | WebEngineSky | SOC-Security-RG |
key: baseline_rbac_3 origin: random role: Owner scope type: resource_group scope ref: SOC-Security-RG |
| OWNS_GROUP | GeoBuilder | Data Strategy |
key: baseline_grpown_0 origin: random |
| OWNS_GROUP | OmniBuilder | Product Support |
key: baseline_grpown_1 origin: random |
| OWNS_GROUP | destiny.girand | Product Support |
key: baseline_grpown_2 origin: random |
| OWNS_APPLICATION | BetaResponder | WebEngineSky |
key: baseline_appown_0 origin: random |
| OWNS_APPLICATION | bryan.ohanesian | WebEngineSky |
key: baseline_appown_1 origin: random |
Cloud Plane
4Resource groups
9Azure resources
1Regions
7Attack paths
Resource Groups (4)
| Object | Properties |
|---|---|
| Tenant-Config-RG |
location: West US 2 name: Tenant-Config-RG |
| Networking-Infra-RG |
location: West US 2 name: Networking-Infra-RG |
| SOC-Security-RG |
location: West US 2 name: SOC-Security-RG |
| Security-Monitoring-RG |
location: West US 2 name: Security-Monitoring-RG |
Key Vaults (3)
| Object | Properties |
|---|---|
| Internal-Svc-KVy5nx |
location: West US 2 name: Internal-Svc-KVy5nx sku name: standard resource group name: Security-Monitoring-RG |
| Prod-Shared-Vaultfdfj |
location: West US 2 name: Prod-Shared-Vaultfdfj sku name: standard resource group name: Tenant-Config-RG |
| IT-Secrets-Vaultxt8e |
location: West US 2 name: IT-Secrets-Vaultxt8e sku name: standard resource group name: Tenant-Config-RG |
Storage Accounts (2)
| Object | Properties |
|---|---|
| InfraAutomationSA3q5 |
resource group name: SOC-Security-RG location: West US 2 name: infraautomationsa3q5 account tier: Standard account replication type: LRS |
| ConfidentialStore01cph |
resource group name: SOC-Security-RG location: West US 2 name: confidentialstore01cph account tier: Standard account replication type: LRS |
Virtual Machines (2)
| Object | Properties |
|---|---|
| Infra-Bkp-01-lz |
vm size: Standard_D2s_v3 resource group name: Networking-Infra-RG location: West US 2 name: Infra-Bkp-01-lz admin username: badzureadmin os type: Linux |
| Infra-Vault-01-5o |
vm size: Standard_D2s_v3 resource group name: SOC-Security-RG location: West US 2 name: Infra-Vault-01-5o admin username: badzureadmin os type: Linux |
Logic Apps (0)
None
Automation Accounts (0)
None
Function Apps (0)
None
App Services (0)
None
Cosmos Dbs (2)
| Object | Properties |
|---|---|
| cosmos-userprofiles-6fv1 |
database name: cosmos-userprofiles-db resource group name: SOC-Security-RG location: West US 2 offer type: Standard name: cosmos-userprofiles-6fv1 kind: GlobalDocumentDB container name: cosmos-userprofiles-container partition key path: /id |
| cosmos-catalog-zkjp |
database name: cosmos-catalog-db resource group name: Networking-Infra-RG location: West US 2 offer type: Standard name: cosmos-catalog-zkjp kind: GlobalDocumentDB container name: cosmos-catalog-container partition key path: /id |
Attack paths
ApplicationOwnershipAbuse (NanoStream)
reachedAttack path from katelyn.subich to ApplicationOwnershipAbuse (NanoStream).
'NanoStream' is controlled by the attacker.
MITRE: T1078.004, T1098.001.
Ordered narrative (3 steps)
- Compromise katelyn.subich
- Take over application via ownership → NanoStream
- Achieve objective: ApplicationOwnershipAbuse (NanoStream)
ApplicationAdministratorAbuse (BetaResponder)
reachedAttack path from bryan.ohanesian to ApplicationAdministratorAbuse (BetaResponder).
'BetaResponder' is controlled by the attacker.
MITRE: T1078.004, T1098.001.
Ordered narrative (3 steps)
- Compromise bryan.ohanesian
- Traverse to → BetaResponder
- Achieve objective: ApplicationAdministratorAbuse (BetaResponder)
CloudAppAdministratorAbuse (DynamicOperatorPro)
reachedAttack path from addie.goheen to CloudAppAdministratorAbuse (DynamicOperatorPro).
'DynamicOperatorPro' is controlled by the attacker.
MITRE: T1078.004, T1098.001.
Ordered narrative (3 steps)
- Compromise addie.goheen
- Traverse to → DynamicOperatorPro
- Achieve objective: CloudAppAdministratorAbuse (DynamicOperatorPro)
Compromise OmniBuilder via looted credential
reachedAttack path from trent.darjean to Compromise OmniBuilder via looted credential.
'OmniBuilder' is controlled by the attacker.
MITRE: T1078.004, T1528, T1555.006.
Ordered narrative (4 steps)
- Compromise trent.darjean
- Control resource (gain its managed identity) → Infra-Bkp-01-lz
- Loot planted credential → OmniBuilder
- Achieve objective: Compromise OmniBuilder via looted credential
Compromise GeoBuilder via looted credential
reachedAttack path from miguel.bemrose to Compromise GeoBuilder via looted credential.
'GeoBuilder' is controlled by the attacker.
MITRE: T1078.004, T1555.006.
Ordered narrative (3 steps)
- Compromise miguel.bemrose
- Loot planted credential → GeoBuilder
- Achieve objective: Compromise GeoBuilder via looted credential
Compromise FuturePulse via looted credential
reachedAttack path from trent.darjean to Compromise FuturePulse via looted credential.
'FuturePulse' is controlled by the attacker.
MITRE: T1078.004, T1552.001.
Ordered narrative (3 steps)
- Compromise trent.darjean
- Loot planted credential → FuturePulse
- Achieve objective: Compromise FuturePulse via looted credential
Compromise WebEngineSky via looted credential
reachedAttack path from bryan.ohanesian to Compromise WebEngineSky via looted credential.
'WebEngineSky' is controlled by the attacker.
MITRE: T1078.004, T1098.001.
Ordered narrative (3 steps)
- Compromise bryan.ohanesian
- Traverse to → WebEngineSky
- Achieve objective: Compromise WebEngineSky via looted credential
Identity / Organization
High-level Entra identity inventory with user, application service-principal, and managed-identity summaries, group structure, and administrative-unit membership counts.
AdministrativeUnitCatalog
Group
IdentityCategory
IdentitySummary
Organization
SecurityPrincipalCatalog
CONTAINS IDENTITY
HAS ADMINISTRATIVE UNITS
HAS IDENTITY CATEGORY
HAS PRINCIPAL CATALOG
SUMMARIZES
Azure Resources
Subscription and resource-group placement with visible inventory totals, resources grouped by type, and missing placement called out explicitly.
CosmosDBSummary
KeyVaultSummary
ResourceGroup
StorageAccountSummary
Subscription
VirtualMachineSummary
CONTAINS
Assignments
Generated assignment families, roles and permissions, summarized by principal type. Select an aggregate for counts and underlying references.
AssignmentCatalog
AssignmentFamily
Permission
PrincipalSummary
Relationship
Role
ASSIGNED TO
CONTAINS FAMILY
CONTAINS KIND
Posture: app_ownership
Legitimate configuration relationships that make this path possible.
Objective
ServicePrincipal
User
OWNS
SATISFIES OBJECTIVE
Attack: app_ownership
Ordered attacker actions from initial access to the path objective.
Attacker
Credential
Identity
Objective
ACHIEVES
ADDS APP CREDENTIAL
AUTHENTICATES AS
COMPROMISES
Posture: app_admin
Legitimate configuration relationships that make this path possible.
EntraRole
Objective
ServicePrincipal
User
HAS ENTRA ROLE
SATISFIES OBJECTIVE
Attack: app_admin
Ordered attacker actions from initial access to the path objective.
Attacker
Credential
Identity
Objective
ACHIEVES
ADDS APP CREDENTIAL
AUTHENTICATES AS
COMPROMISES
Posture: cloud_app_admin
Legitimate configuration relationships that make this path possible.
EntraRole
Objective
ServicePrincipal
User
HAS ENTRA ROLE
SATISFIES OBJECTIVE
Attack: cloud_app_admin
Ordered attacker actions from initial access to the path objective.
Attacker
Credential
Identity
Objective
ACHIEVES
ADDS APP CREDENTIAL
AUTHENTICATES AS
COMPROMISES
Posture: mi_abuse
Legitimate configuration relationships that make this path possible.
Credential
KeyVault
ManagedIdentity
Objective
ServicePrincipal
User
VirtualMachine
CREDENTIAL FOR
HAS AZURE ROLE
HAS CREDENTIAL
RUNS AS
SATISFIES OBJECTIVE
STORES
Attack: mi_abuse
Ordered attacker actions from initial access to the path objective.
Attacker
ComputeResource
Credential
DataResource
Identity
Objective
ACHIEVES
AUTHENTICATES AS
COMPROMISES
EXECUTES ON
READS
STEALS CREDENTIAL
USES MANAGED IDENTITY
Posture: kv_theft
Legitimate configuration relationships that make this path possible.
Credential
KeyVault
Objective
ServicePrincipal
User
CREDENTIAL FOR
HAS AZURE ROLE
HAS CREDENTIAL
SATISFIES OBJECTIVE
STORES
Attack: kv_theft
Ordered attacker actions from initial access to the path objective.
Attacker
Credential
DataResource
Identity
Objective
ACHIEVES
AUTHENTICATES AS
COMPROMISES
READS
STEALS CREDENTIAL
Posture: storage_theft
Legitimate configuration relationships that make this path possible.
Credential
Objective
ServicePrincipal
StorageAccount
User
CREDENTIAL FOR
HAS AZURE ROLE
SATISFIES OBJECTIVE
STORES
Attack: storage_theft
Ordered attacker actions from initial access to the path objective.
Attacker
Credential
DataResource
Identity
Objective
ACHIEVES
AUTHENTICATES AS
COMPROMISES
READS
STEALS CREDENTIAL
Posture: cosmos_theft
Legitimate configuration relationships that make this path possible.
EntraRole
Objective
ServicePrincipal
User
HAS ENTRA ROLE
SATISFIES OBJECTIVE
Attack: cosmos_theft
Ordered attacker actions from initial access to the path objective.
Attacker
Credential
Identity
Objective
ACHIEVES
ADDS APP CREDENTIAL
AUTHENTICATES AS
COMPROMISES