Cybersecurity specialists have introduced advanced methods for detecting misuse of Azure Managed Identities (MIs), tackling a critical, yet often overlooked, vulnerability in cloud security.
While Azure Managed Identities simplify credential management by removing the need for manual secret handling, this convenience opens new doors for cybercriminals. These attackers can exploit these identities to gain elevated privileges and access sensitive data, creating significant security risks.
The research, led by Team Axon, goes beyond just identifying the presence of MIs to focus on detecting unauthorized access and malicious activity. As MIs become more widespread across Azure services, they broaden the attack surface, potentially allowing cyber adversaries to move laterally through systems, access Microsoft Graph, and extract sensitive information from Azure resources.
Despite the security benefits of Azure MIs, such as eliminating static credentials, experts warn that their misuse can be devastating. These identities inherently trust the Azure authentication system, making them a high-value target for attackers.
This work builds on earlier research, particularly Karl Fossaen’s DEF CON 32 presentation “Identity Theft is Not a Joke, Azure!” which first highlighted the risks of MI abuse.
The research introduces twelve specialized detection queries, each designed to uncover different facets of potential MI exploitation. These queries range from highly accurate techniques for detecting direct token requests from virtual machines to broader behavioral analytics that flag abnormal MI access to unusual resources or unusual authentication patterns.
A key technique outlined in the research focuses on identifying Microsoft Graph enumeration activities using compromised MIs. This method detects when an MI makes a suspiciously high number of requests to Microsoft Graph API endpoints, a behavior often associated with threat actors conducting reconnaissance after gaining unauthorized MI access.
The detection query, written in Snowflake SQL, identifies abnormal patterns in Graph API access, such as:
sql
WITH graph_enum_activity AS (
SELECT MIN(time) AS min_event_time,
MAX(time) AS max_event_time,
user_principal_object_id,
ARRAY_AGG(DISTINCT request_uri) AS distinct_request_uris,
COUNT(*) AS amount_of_requests
FROM RAW.MICROSOFT_GRAPH_ACTIVITY_LOGS
WHERE request_method = ‘GET’
GROUP BY user_principal_object_id, hour_of_events
HAVING amount_of_requests > 60
AND amount_of_endpoint_base > 5
AND amount_of_request_uris > 30
)
The query sets specific thresholds for request patterns, highlighting instances where managed identities make an unusually high number of distinct calls to the Graph API within a short period. This detection method works well because legitimate MIs typically show predictable, limited interactions with Graph resources, making suspicious activity stand out.
In addition to detection, the paper also offers actionable advice for incident response, recommending cross-correlation techniques between Azure Sign-in logs, Activity logs, and Microsoft Graph telemetry to track potential compromises in detail.
By implementing these detection strategies, security teams can better identify potential breaches before attackers can fully exploit vulnerabilities in cloud infrastructures and access critical data.
