Azure威胁建模咨询：需覆盖哪些攻击者入侵方式及访问方法

Great questions—building a threat model for Azure is critical, and it’s smart to dig beyond the obvious attack paths. Let’s break this down for you:

Here are the most prevalent ways attackers target Azure access, beyond the chained MFA bypass you’ve already identified:

• Credential Exposure: This is the most common entry point. Attackers might steal username/password pairs via phishing, find hardcoded secrets (like AZURE_CLIENT_SECRET or storage account keys) in public code repos, or extract cached credentials from Azure CLI/PowerShell on compromised devices.
• MFA Bypass Techniques: Beyond chained attacks, other tactics include session hijacking (stealing valid MFA-authenticated cookies), SIM swapping to intercept verification codes, abusing trusted device exemptions, or intercepting OAuth authorization codes in phishing flows.
• Identity Spoofing & Abuse: Attackers might forge tokens from federated identity providers (if your org uses AD FS or third-party IdPs), exploit misconfigured guest accounts with excessive permissions, or leverage privilege escalation paths (e.g., compromising a user with limited access then escalating to global admin via misassigned roles).
• Misconfigured Resources: Publicly exposed storage accounts (with read/write access enabled by mistake), VMs with open RDP/SSH ports without proper network controls, or overprivileged service principals that grant unintended access to core Azure services.
• Supply Chain Compromises: Malicious third-party apps granted Azure AD permissions via consent phishing, or tampered Azure tools (like malicious CLI extensions) that steal credentials during use.

Your threat model needs to cover far more than just authentication-focused attacks—local environments and the Azure portal introduce unique risks you can’t ignore:

Local Environment Attack Paths #

• AD-Azure Sync Vulnerabilities: If your org syncs on-prem AD with Azure AD, attackers who gain admin access to your local AD can escalate that to Azure AD (e.g., modifying sync settings to grant themselves global admin rights).
• Local Credential Theft: Compromised on-prem devices might store Azure-related credentials (like cached portal sessions, local key vault backups, or service principal certificates) that attackers can exfiltrate.
• On-Prem to Azure Bridge Exploits: Vulnerabilities in hybrid connectivity tools (like Azure Arc or VPN gateways) can let attackers pivot from local networks into your Azure environment.

Azure Portal-Specific Attacks #

• Portal Session Hijacking: Stealing valid portal cookies (via XSS attacks on internal tools or phishing) lets attackers access the portal without re-authenticating, even if MFA is enabled.
• Self-Service Feature Abuse: Phishing users to trigger unauthorized password resets or modify account settings via the portal’s self-service tools, bypassing traditional authentication checks.
• Portal API Misuse: Attackers might exploit overprivileged access to Azure Portal management APIs to modify resources, exfiltrate data, or escalate permissions without interacting directly with the portal UI.

Additional Critical Attack Surfaces #

Don’t forget to model risks like:

• Data Exfiltration via SAS Tokens: Stolen or misconfigured Shared Access Signature (SAS) tokens can grant access to storage accounts, even without full Azure AD credentials.
• Service Layer Exploits: Vulnerabilities in Azure services you use (e.g., SQL injection in Azure SQL, code injection in Azure Functions) can let attackers gain access to underlying resources.
• Insider Threats: Malicious or negligent internal users might abuse their existing Azure permissions to exfiltrate data or modify resources.

For your threat modeling, I’d recommend using frameworks like STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) to map out all these attack paths systematically. This ensures you cover both obvious and subtle risks specific to your Azure setup.

内容的提问来源于stack exchange，提问作者McMatty