Azure

This page contains the Stratus attack techniques for Azure, grouped by MITRE ATT&CK Tactic. Note that some Stratus attack techniques may correspond to more than a single ATT&CK Tactic.

Execution

• Execute Command on Virtual Machine using Custom Script Extension

• Execute Commands on Virtual Machine using Run Command

Persistence

• Backdoor Azure Managed Identity with Federated Identity Credential (FIC)

• Create Azure VM Bastion shareable link

• Enable Local Authentication and Exfiltrate Azure AI Foundry API Keys

Privilege Escalation

• Backdoor Azure Managed Identity with Federated Identity Credential (FIC)

• Elevate to User Access Administrator at Root Scope

Credential Access

• Retrieve App Service Publishing Credentials

• Enable Local Authentication and Exfiltrate Azure AI Foundry API Keys

Exfiltration

• Export Disk Through SAS URL

• Exfiltrate Azure Storage via public access

• Exfiltrate Azure Storage through SAS URL

Impact

• Azure Blob Storage ransomware through Encryption Scope using client-managed Key Vault key

• Azure Blob Storage ransomware through Customer-Provided Encryption Keys

• Azure ransomware via Storage Account Blob deletion

• Azure Blob Storage ransomware through Customer-Managed Key Vault key and vault deletion

• Delete Azure resource lock