The Azure Necronomicon: Unraveling Identity's Cosmic Horror

Dive into the eldritch depths of Azure’s identity management, where the seemingly mundane task of handling user identities and service principals transforms into a journey through cosmic horror. In this talk, we will embark on an arcane expedition to decipher the mysteries of Azure identities. Witness how the multitude of GUIDs, those cryptic runes cast by Microsoft into every log, hold the secrets to understanding and mastering the dark arts of cloud identity management.

This session is for those brave souls who dare to confront the bewildering complexity of Azure’s identity services, seeking to cross-correlate the abyssal expanse of activities within the Azure cosmos. Prepare to have the veil lifted on the arcane rituals of authentication, authorization, and the spectral analysis of logs. Whether you are a novice acolyte or a seasoned necromancer of cloud identities, this talk promises revelations that will enlighten, terrify, and empower you to command the forces of Azure’s identity infrastructure.

1. Unraveling Identity's Cosmic Horror Brandon DeVault Sr. Security Researcher, CrowdStrike Cyber Operations, National Guard The Azure Necronomicon:

2. What this talk is NOT A guide on how authentication works in Azure Why you should buy product X over product Y A solution to all your problems

3. Management Control Data Cloud Planes Overall resources and lifecycle Configurations and operations User data processing and storage

4. Management Control Data Cloud Planes Overall resources and lifecycle Configurations and operations User data processing and storage

5. Why not Microsoft security? Who did what?

6. Chapter 1 The Summoning of Users and Service Principals

7. Identities Users Roles Groups Applications Service Principals

8. Users

9. Microsoft Entra ID Tenant Microsoft Entra ID Subscription Azure Environment Resource Group Management Group Microsoft Environment M365 Defender Power Platform Microsoft 365

10. Methods of authenticating Azure Portal Entra ID ADFS Hybrid Authentication (pass-through auth, password hash synchronization, federation with third-party) CLI Interfaces and APIs Managed Identities B2B / B2C SSH Key Authentication Certificate-Based Authentication VPN and Virtual Network Gateways

11. Service Principals / Applications

12. Types of Service Principals Application Managed Identity Legacy

13. Azure Tenant 1 Azure Tenant 2 Entra ID Subscription 1 Application Service Principal Service Resource Resource Resource Subscription 2 Subscription 3 Service Principal Entra ID

14. Groups

15. Management Groups Above Subscriptions Policy / Compliance Resource Groups For grouping resources VMs, web apps, databases, etc. Groups can be nested Management Groups Subscriptions Resources Resource Groups

16. Roles

17. Microsoft Entra ID Tenant Microsoft Entra ID Subscription Azure Environment Resource Group Management Group Microsoft Environment M365 Defender Power Platform Microsoft 365

18. Azure built-in roles Entra built-in roles 312 105

19. High-privileged role

20. Global Unique Identifier (GUID)

21. Chapter 2 The Rituals of Non-Standardization

22. Importance of Field Normalization When searching for a value, all results must be returned Capitalization matters! Improves performance

23. azure.resultType Expectations: Success / Failure True / False

24. azure.resultType Reality:

25. azure.properties.statusCode Expectations: 200 / 400 / 429 “OK” / “ BadRequest ”

26. azure.properties.statusCode Reality:

27. Parse: azure.operationName : “ MICROSOFT.AUTHORIZATION / ROLEASSIGNMENTS / WRITE ”

28. azure.operationName : “ MICROSOFT.AUTHORIZATION / ROLEASSIGNMENTS / WRITE ” Parse:

29. azure.operationName

30. azure.operationName

31. Chapter 3 The Necromancy of Log Analysis

32. Identities (GUID) azure.identity.claims.appid azure.identity.claims.http ://schemas.microsoft.com/identity/claims/ objectidentifier Activity Logs: azure.properties.initiatedBy.app.servicePrincipalId azure.properties.initiatedBy.user.id Audit Logs: azure.properties.servicePrincipalId azure.properties.userId Sign-In Logs:

33. Identities (Human Readable) azure.identity.claims.http ://schemas.xmlsoap.org/ ws /2005/05/identity/claims/name azure.identity.claims.appid azure.properties.initiatedBy.app.displayName azure.properties.initiatedBy.user.displayName azure.properties.initiatedBy.user.userPrincipalName azure.properties.identity azure.properties.userPrincipalName azure.properties.servicePrincipalName Fields:

34. Cross-correlation Activity Log Sign-In Log … azure.identity.claims.appid : <GUID> … … azure.properties.servicePrincipalId : <GUID> …

35. Cross-correlation Activity Log … azure.properties.servicePrincipalId : <GUID> azure.properties.servicePrincipalName : <Name> … Sign-In Log … azure.identity.claims.appid : <GUID> azure.identity.authorization.evidence.roleDefinitionId azure.identity.authorization.evidence.role …

36. Normalized Logs Endpoint EDR Email Authentication Database

37. Key Takeaways – Cthulhu fhtagn ! Identity is hard Normalization is important The power of cross-correlation is critical

38. QUESTIONS? www.devaultsecurity.com linkedin . twitter. devaultsecurity.com github . [email protected] }