corpus.blog
41,554 blogs · 5,181,941 posts Claim your blog
Record · corpus.blog/posts/01a08787-f2db-71d9-933b-e179a0c38a11

How to Detect Malicious Azure Persistence Through Automation Account Abuse

inversecos.com · published 16 December 2021

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at inversecos.com Wayback capture
0blogs citing
First cited
—
Most recent
—
Rank this month
not ranked
External links
18
Words captured
2,150

Cited by

No blog we hold has cited this post yet.

Links from this post

Link
Host
https://www.netspi.com/blog/technical/cloud-penetration-testing/maintaining-azure-persistence-via-automation-accounts/
netspi.com
https://twitter.com/kfosaaen
twitter.com
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjIkSqwzi1s2Bp2s8UFfBPf0-UpfynEuqzCic9PzLKVIL-4LaJtQ4cGngPi3FXDuB1pqYtN15MJUKlmroYairBkWsCOVYdNgMVAo9YKOL3BEz-jwnblfeMZG11v6II5s442GDMlA8_DNYI9/s1695/0.png
blogger.googleusercontent.com
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhPiVUVSpCVcG-NZ4e8nEi4x_KoQv_CLBioUEKiqO7VeoXnFoHcBmAoJzi0-O-0Ce-oJjaHJY59Q7A3HxFw3hHvauTkJaLXNHdbR0c_e4HWlPYBI5vEhpMceGoaEEEmCwpaIk3_WhelHvM9/s1445/1.png
blogger.googleusercontent.com
https://github.com/NetSPI/MicroBurst/blob/master/Misc/AutomationRunbook-OwnerPersist.ps1
github.com
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEipFuDM5De_LJf7DdAbnktrTgcHJjsYUFdSGTvibHZlylwWUcj7RfpAcFZvNz8RwDFjAXRQZP92QESLhPIxuzPcORE-WTddVfUI_biMqRigg3Jdqu1EAXAYtSE-SyauTi0EXpp0EfkE76oY/s1714/2.png
blogger.googleusercontent.com
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhIyS-faV5ZtF_1RYape0vO-Wcv4pc8oBKuUAbdPEKmE40jVnPzSRDAWAyeIrHAd2-vgij9DElsqJalwr7fIb3ne_3uRqDHKDFtjkPjp3ace_pJuUWUPNdAbRGrqgnP7X2tdGZnoyL92sGH/s2529/3.png
blogger.googleusercontent.com
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjCmJrz_lW8sSM-XOklSFPHtaTyq4A22gCkXq2KLYasfvkNVMkSWJ0fBH8Kn-uYGNd2Y93NHEnra58pzuL6Zt3o_pA8M155XiS7TP0v05zEBn5tOpVMPZeCNqSYFVi95vIUAcVhmeixWOHv/s889/4.png
blogger.googleusercontent.com
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiCCNFF3FWisYaoG9QTVLfqJBqKpOygnGdIB_WDBlUj9JhSD9CI3AzBr6AMui5SZ4_e2SHl4jgr-800cBWsH3ydZLrbTED7IadzcVBkMbJizKkHuY-eucvEfA8mDbQtEyQ68Kp_dBzChSMD/s2513/5.png
blogger.googleusercontent.com
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjOCSWzwBXbJAX9XPpyIYmz94nEFuVv4TlRyb_RdqtR0dl9V9JbjKaIV4Cqqp_iWALQR-yObnxJeU1DbNUU6zW5XUph0mvU7zVUkuyImE32LuBa0z2def9ymdj0nUIBgEB6866p8gzobcPZ/s1926/6.png
blogger.googleusercontent.com
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhanBB_wihOlPHFnjuPZRgGMKB1RYcYpfATqqFI9IDFCif6c0BJKWd43SwqIMyidsOCQDpQYpvSVswXSeWxa8kmHrrC81ta61lQVf_4mbpduToKUcdBDHcTYwlQt-n4RcLi0InqCHje2Jy9/s1750/7.png
blogger.googleusercontent.com
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgOc3SIECKETU1iGavKuK7OCta0uVW0jXWUBwcSJJv-C8kgY14mY6DCsBrsqxc0f1B9HKD4sE_3TAodyCOOPIXbr2Zq5oNkZzf_AkAX8aUgcZVuBmwX5PJq8CERyhLw3E5yoX_fdl2_L_sV/s799/8.png
blogger.googleusercontent.com
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgY3Ih9eXZcP43l2wtaBZzXj2jg1ZHow1GFiaaVKCtZwq7BGNtoDATl8CYln7UoyvfUOxbz9krA1stpTF5ileOr9I_Ve30vfnNeXNo-FyV52aGkTtD0Htj-UrdCQzZDvKW5BmeNeRQKwq8N/s805/1.CreateAutomationAcc.png
blogger.googleusercontent.com
https://github.com/NetSPI/MicroBurst/blob/master/Misc/AutomationRunbook-OwnerPersist.ps
github.com
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiyFy8eZbbIHyZ271btwWN1g69YC3LvoOMt_PqUYBbSzM1ieuAmXqe3QJgC8RZfj5MD85LUajIiJbNuhqqMZCj5Zdw7tT1bO9NYv5Xzw5rpXhBokfIy4g6_yYZBPeUirYj2Fkht6Lraz294/s808/importRunbook.png
blogger.googleusercontent.com
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgSa32AoAoCp5IbBP3sfNyXx50B6JuBI59tQvTMMfB9M8v4pIhKc5uXWrDhcwQH4UBi9CFFwVIols6xpipqUqGcrC29bXk5MH88l2TDdXJHoBSOprKom1uE-tQD_JQFs56e4mtuIWy8v_sN/s896/AddPermissionsToUserAdmin.png
blogger.googleusercontent.com
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgcrgK7dZOpko68UFGMem5NAKvnJGu2JwIOjK7gYLNh11Bcj9M5lpEn5SfBOS5LAathUFqc4FvSW0q1R0qfaM4BUisGGxUGVMeWf10rvWBZRpC6spyILZi3GDkic2atxTgwa-kEzrRymVL4/s551/CreateWebhook.png
blogger.googleusercontent.com
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgB6HP5hgmJfSiIYWE5MKVi78M7OilR0-IjhpEp4HjTvwpG7EVOfCiSAAjjmYMlXhv11H8NbgbmL-Gesuh7sjY-1x5XIOz3sx9e1YDeCckBOq9-Yu76W41wxkPI33mUiwgYtTA4B-vZMi1D/s1170/Success%2521.png
blogger.googleusercontent.com
Elsewhere on inversecos.com (4)