Azure Enrichment and Remediation

This script takes in a list of numbers that represent Azure priorities for NSG rules, a target priority number, and a number available priorities to return available priorities from the provided list.

Azure Credentials Rotation Playbook

IAM Remediation

Protect your identity and access management:

• Reset Password: Resets the user password to halt any unauthorized access.

• Revoke Session: Terminates current active sessions to ensure the malicious actor is locked out.

• Combo Action: Resets the password and terminates all active sessions.

Service Principal Remediation

Guard your applications:

• Password Regeneration: Generate a new password for the service principal, making sure the old one becomes obsolete.

This playbook performs an investigation on a specific user in Azure environments, using queries and logs from Azure Log Analytics to locate the following activities performed by the user:

• Script-based user agent usage
• Administrative user activities
• Security rules and policies changes
• Failed login attempt
• MFA failed login attempt
• Login attempt from an uncommon country
• Anomalies activities
• Risky users
• Uncommon high volume of actions
• Action uncommonly performed by the user

This playbook provides response actions to Azure. The following are available for execution automatically/manually:

• Resource remediation
  • Delete the instance
  • Power off the instance
• Identity remediation:
  • Disable the user
  • Delete the user
• Block indicators.

Given an IP address, this playbook enriches Azure Compute, Microsoft Graph User, and IAM information and outputs Azure Compute, Microsoft Graph User, and IAM information.

This playbook adds new Azure Network Security Groups (NSG) rules to NSGs attached to a NIC. The new rules will give access only to a private IP address range and block traffic that's exposed to the public internet (using the private IP of the VM as stated in Azure documentation). For example, if RDP is exposed to the public internet, this playbook adds new firewall rules that only allow traffic from private IP addresses and blocks the rest of the RDP traffic.

Conditions and limitations:

• Limited to one resource group.
• 200 Azure rules viewed at once to find offending rule.
• 2 priorities lower than the offending rule priority must be available.
• Adds rules to NSGs associated to NICs.

This script takes in a list of numbers that represent Azure priorities for NSG rules, a target priority number, and a number available priorities to return available priorities from the provided list.

Given an IP address, this playbook enriches Azure Compute, Microsoft Graph User, and IAM information and outputs Azure Compute, Microsoft Graph User, and IAM information.

This playbook adds new Azure Network Security Groups (NSG) rules to NSGs attached to a NIC. The new rules will give access only to a private IP address range and block traffic that's exposed to the public internet (using the private IP of the VM as stated in Azure documentation). For example, if RDP is exposed to the public internet, this playbook adds new firewall rules that only allow traffic from private IP addresses and blocks the rest of the RDP traffic.

Conditions and limitations:

• Limited to one resource group.
• 200 Azure rules viewed at once to find offending rule.
• 2 priorities lower than the offending rule priority must be available.
• Adds rules to NSGs associated to NICs.

This playbook provides response actions to Azure. The following are available for execution automatically/manually:

• Resource remediation
  • Delete the instance
  • Power off the instance
• Identity remediation:
  • Disable the user
  • Delete the user
• Block indicators.

Azure Credentials Rotation Playbook

IAM Remediation

Protect your identity and access management:

• Reset Password: Resets the user password to halt any unauthorized access.

• Revoke Session: Terminates current active sessions to ensure the malicious actor is locked out.

• Combo Action: Resets the password and terminates all active sessions.

Service Principal Remediation

Guard your applications:

• Password Regeneration: Generate a new password for the service principal, making sure the old one becomes obsolete.

This playbook performs an investigation on a specific user in Azure environments, using queries and logs from Azure Log Analytics to locate the following activities performed by the user:

• Script-based user agent usage
• Administrative user activities
• Security rules and policies changes
• Failed login attempt
• MFA failed login attempt
• Login attempt from an uncommon country
• Anomalies activities
• Risky users
• Uncommon high volume of actions
• Action uncommonly performed by the user