BSides NYC 2025: Inside Cloud Attack Paths End-to-End Adversary Simulation

Adversaries map and navigate cloud attack paths by chaining misconfigurations, over-privileged principals, and exposed secrets in pursuit of privilege escalation and broader objectives. In this talk, we explore core attack primitives in Azure, Entra ID, and Microsoft 365, demonstrate how to simulate end-to-end attack chains, and analyze the resulting telemetry to uncover the traces these attacks leave behind.

1. Inside Cloud Attack Paths:
End-to-End Adversary
Simulation
Mauricio Velazco
Bsides NYC 2025

2. #whoami

✘Security Research @ Microsoft

✘@mvelazco

✘github.com/mvelazc0

3. 1

introduction

4. “
A cloud attack path is the chain
of steps an adversary follows by
compromising identities and
abusing legitimate
configurations to reach a goal

5. How Are Cloud Attack Paths created
✘Security Principals (who):

Users - App Registrations/ Service Principals -
Managed Identities

✘Permissions (what):

Direct Object Permissions - Entra ID Roles -
Azure RBAC - API Permissions - OAuth Scopes

✘Targets (where):

EntraID Tenants - Azure Subscriptions - Key
Vaults - Storage Accounts - Databases -
Exchange Online - OneDrive - SharePoint

6. How Are Cloud Attack Paths created
✘Security Principals (who):

Users - App Registrations/ Service Principals -
Managed Identities

✘Permissions (what):

Direct Object Permissions - Entra ID Roles -
Azure RBAC - API Permissions - OAuth Scopes

✘Targets (where):

EntraID Tenants - Azure Subscriptions - Key
Vaults - Storage Accounts - Databases -
Exchange Online - OneDrive - SharePoint
User
Bob

7. How Are Cloud Attack Paths created
✘Security Principals (who):

Users - App Registrations/ Service Principals -
Managed Identities

✘Permissions (what):

Direct Object Permissions - Entra ID Roles -
Azure RBAC - API Permissions - OAuth Scopes

✘Targets (where):

EntraID Tenants - Azure Subscriptions - Key
Vaults - Storage Accounts - Databases -
Exchange Online - OneDrive - SharePoint
User
Bob


PrivEsc
App
ACME

8. How Are Attack Paths created
✘Security Principals (who):

Users - App Registrations/ Service Principals -
Managed Identities

✘Permissions (what):

Direct Object Permissions - Entra ID Roles -
Azure RBAC - API Permissions - OAuth Scopes

✘Targets (where):

EntraID Tenants - Azure Subscriptions - Key
Vaults - Storage Accounts - Databases -
Exchange Online - OneDrive - SharePoint
User
Bob


PrivEsc
App
ACME
SP
acme-sp


RunsAs

9. How Are Attack Paths created
✘Security Principals (who):

Users - App Registrations/ Service Principals -
Managed Identities

✘Permissions (what):

Direct Object Permissions - Entra ID Roles -
Azure RBAC - API Permissions - OAuth Scopes

✘Targets (where):

EntraID Tenants - Azure Subscriptions - Key
Vaults - Storage Accounts - Databases -
Exchange Online - OneDrive - SharePoint
User
Bob


PrivEsc
App
ACME
SP
acme-sp
VMContri
butor


HasRole


RunsAs

10. How Are Cloud Attack Paths created
✘Security Principals (who):

Users - App Registrations/ Service Principals -
Managed Identities

✘Permissions (what):

Direct Object Permissions - Entra ID Roles -
Azure RBAC - API Permissions - OAuth Scopes

✘Targets (where):

EntraID Tenants - Azure Subscriptions - Key
Vaults - Storage Accounts - Databases -
Exchange Online - OneDrive - SharePoint
User
Bob


PrivEsc
App
ACME
SP
acme-sp
VMContri
butor


HasRole


RunsAs


CanExec
VM:
Gibson01

11. How Are Attack Paths created
✘Security Principals (who):

Users - App Registrations/ Service Principals -
Managed Identities

✘Permissions (what):

Direct Object Permissions - Entra ID Roles -
Azure RBAC - API Permissions - OAuth Scopes

✘Targets (where):

EntraID Tenants - Azure Subscriptions - Key
Vaults - Storage Accounts - Databases -
Exchange Online - OneDrive - SharePoint
User
Bob


PrivEsc
App
ACME
SP
acme-sp
VMContri
butor


HasRole


RunsAs


CanExec
VM:
Gibson01


CanRead
StoreA:
sensitive

12. Attack Primitives
✘Definition

A reusable capability (configuration, permission, or credential) that an adversary abuses within
an attack path to move laterally, escalate privileges or access data inside a tenant.

✘Examples

Service Principal Credential Injection: Abuse a permission (Entra ID Role or direct Owner
assignment) create client secrets or upload certifications for any app registration.

MailBox Access: Abuse the Graph Mail.Read Application permission to exfiltrate mailbox contents
via Microsoft Graph API.

KeyVault Secret Access: With Key Vault Contributor on the vault scope, modify access policies so
an a new identity can read secrets.

13. 2

Provisioning Attack
Paths

14. Requirements
✘Security Principals (who):

Users - App Registrations/ Service Principals -
Managed Identities (Azure Resources)

✘Permissions (what):

Direct Object Permissions - Entra ID Roles -
Azure RBAC - API Permissions - OAuth Scopes

✘Targets (where):

EntraID Tenants - Azure Subscriptions - Key
Vaults - Storage Accounts - Databases -
Exchange Online - OneDrive - SharePoint

15. ✘Leverages Python & Terraform to
automate the setup of EntraID
tenants & Azure subscriptions.

✘Creates random identities,
resources, assignments and
permissions.

✘Injects configurable attack
paths to enable attack path
research
BadZure
https://github.com/mvelazc0/BadZure

16. BadZure

✘Flexible
configuration
through a YAML
file.

17. Attack Path 1
User:
Bob


IsOwner
App:
Acme
SP:
Acme
Priv
Role
Adm


RunsAs


HasRole

18. Attack Path 2
User:
Alice


IsOwner
App:
Omni
SP:
Omni
AppRoleA
ssignmen
t.ReadWri
te.All


RunsAs


HasAPI

19. Attack Path 3
User:
Paul


HasKvCo
KV:
AppSec
App:
Atlas
Mail.Read


HasCred


HasAPI
SP:
Atlas


RunsAs

20. Attack Path 4
User:
Tom


CanExec
VM:
HR01
Managd
Identity
App:
Corex


Contains
SA:
CrtStor


CanRead






ContainCert


RunsAs
SP:
Corex


HasApi
Files.Read
All

21. Provisioning Attack Paths with BadZure

Demo 1

22. 3

Navigating Attack Paths

23. msInvader

✘Adversary simulation tool
designed to automate the
execution of attack paths
against EntraID, M365 & Azure.

✘Leverages APIs like MS Graph,
EWS and ARM for comprehensive
simulations and technique
variations.
https://github.com/mvelazc0/msInvader

24. msInvader

✘Flexible
configuration
through a YAML
file.

25. Attack Path 1
User:
Bob


IsOwner
App:
Acme
SP:
Acme
Priv
Role
Adm


RunsAs


HasRole

26. Attack Path 1
compromised_user
enumerate_users
method: Graph
enumerate_groups
method: Graph







enumerate_applications
method: Graph
enumerate_directory_roles
method: Graph
add_application_secret
method: ARM







get_ms_client_token
assigh_app_role
method: Graph
create_user
method: Graph







assign_entra_role

27. Attack Path 3
User:
Paul


HasKvCo
KV:
AppSec
App:
Atlas
Mail.Read


HasCred


HasAPI
SP:
Atlas


RunsAs

28. Attack Path 3
compromised_user
enumerate_users
method: Graph
enumerate_groups
method: Graph







enumerate_arm_resources
method: ARM
enumerate_arm_role_assign
method: ARM
list_key_vaults
method: ARM







access_key_vault_item
method:
add_keyvault_access_policy
method: Graph
access_key_vault_item
method: Graph







get_ms_token_clientenumerate_arm_role_assign
method: ARM
ream_email

29. Navigating Attack Paths with MsInvader

Demo 2

30. https://github.com/mvelazc0/BadZure https://github.com/mvelazc0/msInvader

31. Resources
✘https://aadinternals.com/

✘https://dirkjanm.io/

✘https://medium.com/@_wald0

✘https://www.netspi.com/authors/karl-fosaaen/

✘https://specterops.io/wp-content/uploads/sites/3/2025/07/StateofAttackPathManagement
-2025-Web.pdf

✘https://cloudbrothers.info/en/azure-attack-paths/

✘https://github.com/SpecterOps/BloodHound/

32. thanks!

33. Inside Cloud Attack Paths:
End-to-End Adversary
Simulation
Mauricio Velazco
Bsides NYC 2025