Professional Documents
Culture Documents
Azure Defender 2021 Maxime 4
Azure Defender 2021 Maxime 4
Email : [email protected]
Github : https://github.com/zigmax
Twitter : @zig_max
“Any views or opinions expressed in this presentation are those of the presenter
and not necessarily represent the view and opinions of my employer, its
ownership, management or its employees.“
Thanks!
Session Agenda / Goal
● Azure Security Overview
● Azure Defender
● Alert - Notification
● Alert Simulation
● Azure Graph
● Alert Automation
https://docs.microsoft.com/en-us/azure/security-center/alerts-reference
Alert (alert type) Description MITRE tactics Severity
Digital currency mining Kubernetes audit log analysis detected a container that has an Execution High
container detected image associated with a digital currency mining tool
Anonymous access to a Indicates that there's a change in the access pattern to a storage Exploitation High
storage account account. For instance, the account has been accessed
(Storage.Blob_AnonymousAc anonymously (without any authentication), which is unexpected
cessAnomaly) compared to the recent access pattern on this account. A
potential cause is that an attacker has exploited public read
access to a container that holds blob storage.
Applies to: Azure Blob Storage
Access from a TOR exit node A key vault has been accessed from a known TOR exit node. Credential Medium
to a key vault This could be an indication that a threat actor has accessed the Access
KV_TORAccess key vault and is using the TOR network to hide their source
location. We recommend further investigations.
https://docs.microsoft.com/en-us/azure/security-center/alerts-reference
● Azure Defender for servers ● Azure Defender for container registries
● Azure Defender for App Service ● Azure Defender for Key Vault
● Azure Defender for Storage ● Azure Defender for Resource Manager
● Azure Defender for SQL ● Azure Defender for DNS
● Azure Defender for Kubernetes
https://www.eshlomo.us/monitor-azure-security-center-with-azure-sentinel/
https://www.eshlomo.us/monitor-azure-security-center-with-azure-sentinel/
https://www.eshlomo.us/monitor-azure-security-center-with-azure-sentinel/
https://www.eshlomo.us/monitor-azure-security-center-with-azure-sentinel/
https://www.eshlomo.us/monitor-azure-security-center-with-azure-sentinel/
https://www.eshlomo.us/monitor-azure-security-center-with-azure-sentinel/
Azure Sentinel Threat Hunting
https://www.eshlomo.us/monitor-azure-security-center-with-azure-sentinel/
https://www.eshlomo.us/monitor-azure-security-center-with-azure-sentinel/
https://www.eshlomo.us/monitor-azure-security-center-with-azure-sentinel/
Export - Alerts to SIEM
Alert - Notification
Alert - Notification
Slack
Slack
Alert - Simulation
Azure Alert - Simulation
● App Service / Suspicious WordPress theme invocation detected
● App Service / Phishing content hosted on Azure Webapps
● App Service / Attempt to run high privilege command detected
● AKS / Exposed Kubernetes dashboard detected
● AKS / Container with a sensitive volume detected
● AKV / Access from a TOR exit node to a Key Vault
● AKV / High volume of operations in a Key Vault
● AKV / Suspicious secret listing and query in a Key Vault
● SQL / Unusual export location
● SQL / Attempted logon by a potentially harmful application
● SQL / Logon from an unusual location
● SQL / Potential SQL injection
● Storage / Unusual amount of data extracted from a storage account
● Storage / Unusual change of access permissions in a storage account
● Windows / Detected Petya ransomware indicators
● Windows / Executable found running from a suspicious location
Azure Graph
Alert Automation
Azure Defender for IoT
Azure Security Center - Multi Cloud
● Automatic agent provisioning (Security Center uses Azure Arc to deploy the Log Analytics agent
to your AWS instances)
● Policy management
● Vulnerability management
● Embedded Endpoint Detection and Response (EDR)
● Detection of security misconfigurations
● A single view showing Security Center recommendations and AWS Security Hub findings
● Incorporation of your AWS resources into Security Center's secure score calculations
● Regulatory compliance assessments of your AWS resources
SC-200
Mitigate threats using Microsoft 365 Defender (25-30%)
● Detect, investigate, respond, and remediate threats to the productivity environment by using Microsoft Defender for
Office 365
● Detect, investigate, respond, and remediate endpoint threats by using Microsoft Defender for Endpoint
● Detect, investigate, respond, and remediate identity threats
● Manage cross-domain investigations in Microsoft 365 Defender Portal
https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE4Myp3
SC-200
Mitigate threats using Azure Sentinel (40-45%)
https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE4Myp3
AZ-500
https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE3VC70
https://www.linkedin.com/learning/microsoft-azure-la-securite/decouvrir-azure-policy
Technical Resources
● Microsoft Ignite 2020 - https://myignite.microsoft.com/home