corpus.blog
44,394 blogs · 5,475,563 posts Claim your blog
Record · corpus.blog/posts/01a0d4a9-87ae-72ad-ae40-1e47c2a028b3

Cloud Discovery With AzureHound

Unit 42 · published 24 October 2025

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at unit42.paloaltonetworks.com Wayback capture
1blog citing
First cited
2 Feb 2026
Most recent
2 Feb 2026
Rank this month
not ranked
External links
61
Words captured
5,855

Cited by

Blog
In the post
Date
heilancoos.github.io
Understanding Identity Abuse in Entra ID through a Case Study (Xintra) Read at the source ↗
2 Feb 2026

Links from this post

Link
Host
https://www.paloaltonetworks.com/cortex/cloud
paloaltonetworks.com
https://docs-cortex.paloaltonetworks.com/p/XSIAM
docs-cortex.paloaltonetworks.com
https://www.paloaltonetworks.com/apps/pan/public/downloadResource?pagePath=/content/pan/en_US/resources/datasheets/prisma-access-browser
paloaltonetworks.com
https://www.paloaltonetworks.com/resources/datasheets/unit-42-cloud-security-assessment
paloaltonetworks.com
https://github.com/SpecterOps/AzureHound
github.com
https://github.com/SpecterOps/BloodHound
github.com
https://learn.microsoft.com/en-us/graph/use-the-api
learn.microsoft.com
https://learn.microsoft.com/en-us/microsoft-365/enterprise/microsoft-365-overview?view=o365-worldwide
learn.microsoft.com
https://learn.microsoft.com/en-us/entra/fundamentals/whatis
learn.microsoft.com
https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/overview
learn.microsoft.com
https://www.microsoft.com/en-us/security/blog/2023/09/14/peach-sandstorm-password-spray-campaigns-enable-intelligence-collection-at-high-value-targets/
microsoft.com
https://www.microsoft.com/en-us/security/blog/2025/05/27/new-russia-affiliated-actor-void-blizzard-targets-critical-sectors-for-espionage/
microsoft.com
https://www.microsoft.com/en-us/security/blog/2025/08/27/storm-0501s-evolving-techniques-lead-to-cloud-based-ransomware/
microsoft.com
https://attack.mitre.org/matrices/enterprise/
attack.mitre.org
https://attack.mitre.org/tactics/TA0007/
attack.mitre.org
https://attack.mitre.org/matrices/enterprise/cloud/
attack.mitre.org
https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference
learn.microsoft.com
https://bloodhound.specterops.io/collect-data/ce-collection/azurehound-flags
bloodhound.specterops.io
https://attack.mitre.org/techniques/T1087/004/
attack.mitre.org
https://learn.microsoft.com/en-us/entra/identity-platform/security-tokens
learn.microsoft.com
https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-device-code
learn.microsoft.com
https://bloodhound.specterops.io/collect-data/ce-collection/azurehound
bloodhound.specterops.io
https://docs.an
docs.an
https://attack.mitre.org/software/S1148/
attack.mitre.org
https://thehackernews.com/2025/05/from-infection-to-access-24-hour.html
thehackernews.com
https://attack.mitre.org/techniques/T1069/003/
attack.mitre.org
https://learn.microsoft.com/en-us/rest/api/storagerp/storage-accounts/get-properties
learn.microsoft.com
https://learn.microsoft.com/en-us/azure/storage/common/storage-account-overview
learn.microsoft.com
https://learn.microsoft.com/en-us/azure/storage/common/storage-network-security
learn.microsoft.com
https://learn.microsoft.com/en-us/azure/storage/common/storage-network-security-trusted-azure-services
learn.microsoft.com
https://attack.mitre.org/techniques/T1526/
attack.mitre.org
https://www.paloaltonetworks.com/cyberpedia/anatomy-ci-cd-pipeline-attack
paloaltonetworks.com
https://attack.mitre.org/techniques/T1580/
attack.mitre.org
https://learn.microsoft.com/en-us/azure/security/fundamentals/identity-management-best-practices
learn.microsoft.com
https://learn.microsoft.com/en-us/azure/security/fundamentals/steps-secure-identity
learn.microsoft.com
https://learn.microsoft.com/en-us/entra/identity/conditional-access/overview
learn.microsoft.com
https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-token-protection
learn.microsoft.com
https://techcommunity.microsoft.com/blog/microsoft-entra-blog/microsoft-graph-activity-log-is-now-available-in-public-preview/3848269
techcommunity.microsoft.com
https://techcommunity.microsoft.com/blog/microsoft-entra-blog/microsoft-graph-activity-logs-is-now-generally-available/4094535
techcommunity.microsoft.com
https://techcommunity.microsoft.com/blog/microsoftsecurityexperts/cloud-forensics-why-enabling-microsoft-azure-graph-activity-logs-matters/4234632
techcommunity.microsoft.com
https://learn.microsoft.com/en-us/rest/api/azure/
learn.microsoft.com
https://learn.microsoft.com/en-us/azure/azure-monitor/platform/monitor-azure-resource
learn.microsoft.com
https://learn.microsoft.com/en-us/azure/azure-monitor/platform/activity-log?tabs=log-analytics
learn.microsoft.com
https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/control-plane-and-data-plane
learn.microsoft.com
https://github.com/SpecterOps/AzureHound/blob/main/client/storage_accounts.go
github.com
https://github.com/SpecterOps/AzureHound/blob/main/client/roles.go
github.com
https://github.com/SpecterOps/AzureHound/blob/main/constants/environments.go
github.com
https://learn.microsoft.com/en-us/entra/identity-platform/authentication-national-cloud
learn.microsoft.com
https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-noninteractive-sign-ins
learn.microsoft.com
https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-sign-ins
learn.microsoft.com
https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-audit-logs
learn.microsoft.com
https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-graphapiauditevents-table
learn.microsoft.com
https://learn.microsoft.com/en-us/defender-xdr/data-privacy
learn.microsoft.com
https://www.huntress.com/blog/threat-hunting-for-business-email-compromise-through-user-agents
huntress.com
https://docs-cortex.paloaltonetworks.com/r/Cortex-XSIAM/Cortex-XSIAM-Documentation/bin
docs-cortex.paloaltonetworks.com
https://docs-cortex.paloaltonetworks.com/r/Cortex-XSIAM/Cortex-XSIAM-Documentation/comp
docs-cortex.paloaltonetworks.com
https://docs-cortex.paloaltonetworks.com/r/Cortex-XSIAM/Cortex-XSIAM-Documentation/count
docs-cortex.paloaltonetworks.com
https://docs-cortex.paloaltonetworks.com/r/Cortex-XSIAM/Cortex-XSIAM-Documentation/Cortex-XSIAM-XQL
docs-cortex.paloaltonetworks.com
https://www.paloaltonetworks.com/blog/security-operations/detecting-threats-with-microsoft-graph-activity-logs/
paloaltonetworks.com
https://docs-cortex.paloaltonetworks.com/r/Cortex-XSIAM/Cortex-XSIAM-Premium-Documentation/What-is-Cortex-Cloud-Identity-Security
docs-cortex.paloaltonetworks.com
https://bloodhound.specterops.io/collect-data/ce-collection
bloodhound.specterops.io
Elsewhere on unit42.paloaltonetworks.com (7)