Platform: Azure

Azure Storage Anonymous Blob Access to Unusual Resource

Sep 11, 2026 · Domain: Cloud Data Source: Azure Data Source: Azure Platform Logs Platform: Azure Service: Azure Storage Use Case: Threat Detection Tactic: Discovery Tactic: Collection Resources: Investigation Guide ·

Share on:

Identifies the first time an Azure Storage resource receives an anonymous data-plane read (GetBlob and related Get or List operations). Anonymous requests are used to probe public containers and to test stolen blob URLs before a SAS is appended. First-seen resource ID keeps volume down while still covering WireServer-related probes of status or extension blobs.

Azure WireServer HTTP Request from Unexpected User Agent

Sep 11, 2026 · Domain: Cloud Domain: Network OS: Linux OS: Windows Platform: Azure Use Case: Threat Detection Tactic: Credential Access Tactic: Discovery Data Source: Network Packet Capture Resources: Investigation Guide ·

Share on:

Identifies HTTP requests to Azure WireServer (168.63.129.16) for GoalState, certificates, versions, or HostGAPlugin vmSettings that do not use a known guest-agent user agent. These requests retrieve transport certificates and extension protectedSettings, including embedded SAS URLs. Azure Linux Agent, Windows guest agent, and related platform UAs are excluded. Requests with no user agent are also excluded; that pattern is common for the Windows guest agent.

Azure WireServer OpenSSL Certificate Decrypt or LinuxTransport Generation

Sep 11, 2026 · Domain: Endpoint Domain: Cloud OS: Linux Use Case: Threat Detection Platform: Azure Platform: Linux Tactic: Credential Access Tactic: Defense Evasion Data Source: Elastic Defend Resources: Investigation Guide ·

Share on:

Identifies OpenSSL generating a CN=LinuxTransport certificate or decrypting CMS/PKCS7 payloads with a key that is not the Azure Linux Agent certificate under /var/lib/waagent. Adversaries can scrape WireServer certificates, mint a LinuxTransport identity, and decrypt extension protectedSettings with openssl cms -decrypt or smime -decrypt.

Azure WireServer Unusual Process Connection

Sep 11, 2026 · Domain: Endpoint Domain: Cloud OS: Linux OS: Windows Platform: Azure Platform: Windows Use Case: Threat Detection Tactic: Credential Access Tactic: Discovery Data Source: Elastic Defend Resources: Investigation Guide ·

Share on:

Identifies shells, LOLBins, GTFOBins, and scripting runtimes connecting to the Azure WireServer / HostGAPlugin address 168.63.129.16 on ports 80 or 32526. The guest agent uses this fabric endpoint for GoalState, certificates, and vmSettings. Adversaries with code execution on an Azure VM (including via Run Command) use curl, PowerShell, openssl, bun, or similar tools to enumerate versions, pull transport certificates, and read HostGAPlugin /vmSettings. Azure guest-agent binaries and system python used by waagent are excluded. Descendants of the guest agent are not excluded: Run Command payloads execute in that tree.

Azure RBAC Built-In Administrator Roles Assigned

Aug 27, 2026 · Domain: Cloud Domain: Identity Data Source: Azure Data Source: Azure Activity Logs Platform: Azure Rule Type: Custom Query (KQL) Use Case: Identity and Access Audit Tactic: Privilege Escalation Tactic: Persistence Resources: Investigation Guide ·

Share on:

Identifies when a user is assigned a built-in administrator role in Azure RBAC (Role-Based Access Control). These roles provide significant privileges and can be abused by attackers for lateral movement, persistence, or privilege escalation. The privileged built-in administrator roles include Owner, Contributor, User Access Administrator, Azure File Sync Administrator, Reservations Administrator, and Role Based Access Control Administrator.