Monday , May 27 2024
Azure

Azure Logs utilizing to identify threats: Insights From Microsoft

Microsoft security experts recently conducted an exploration on how to effectively use Azure Logs to identify and counteract threat actions. Azure’s defense mechanism relies on effectively understanding and using logs to hunt for threats.

Microsoft focuses on integrating best practices for log management, analysis, and incident response to stay proactive against evolving cyber threats.

Researcher claimed: Biometrics of Indian Forces Exposed

Jeremiah Fowler, a security researcher, claimed to discover a major vulnerability in India's data security. He found an unprotected database...
Read More
Researcher claimed: Biometrics of Indian Forces Exposed

NSA Releases Guidance on Zero Trust Maturity

The NSA released an information sheet called "Advancing Zero Trust Maturity Throughout the Application and Workload Pillar." This sheet will...
Read More
NSA Releases Guidance on Zero Trust Maturity

Data protection is sovereignty: Mohammad A. Arafat
INFOCOM Dhaka ends promoting cyber resiliency

The two day long 7th edition of INFOCOM, India's biggest business, technology, and leadership event, themed "Sustainable Disruption", concluded today...
Read More
Data protection is sovereignty: Mohammad A. Arafat  INFOCOM Dhaka ends promoting cyber resiliency

Phoenix Summit 2024
Two days phoenix summit ended successfully at Dhaka

TheTeamPhoenix, a non-profit organization, successfully hosted Phoenix Summit 2024, the largest cyber security event in Bangladesh, from May 23-24. This...
Read More
Phoenix Summit 2024  Two days phoenix summit ended successfully at Dhaka

CISA Added Apache Flink CVE-2020-17519 Vulnerability to KEV

CISA warns Apache Flink users about a critical vulnerability. Cybercriminals are exploiting this flaw to compromise systems. Apache Flink is...
Read More
CISA Added Apache Flink CVE-2020-17519 Vulnerability to KEV

Cisco released software updates for CVE 2024-20360

Cisco, a global network solutions leader, has reported a security issue with its Firepower Management Center (FMC) software. This vulnerability,...
Read More
Cisco released software updates for CVE 2024-20360

Ivanti Patches Critical RCE Flaws in Endpoint Manager

Ivanti on Tuesday declare to patch for several products, including fixes for critical vulnerabilities in Endpoint Manager (EPM). Ivanti resolved...
Read More
Ivanti Patches Critical RCE Flaws in Endpoint Manager

German police warn of cyberattacks via Office 365

ompanies in Germany are facing a new wave of cyberattacks. The State Criminal Police Office of North Rhine-Westphalia has issued...
Read More
German police warn of cyberattacks via Office 365

Hacktivists group target Philippines government ransomware attack

SentinelOne researchers found that the Ikaruz Red Team is targeting the Philippines government using different ransomware builders like LockBit, Vice...
Read More
Hacktivists group target Philippines government ransomware attack

CISA ALERT
CISA Warns Exploiting NextGen Healthcare Mirth Connect Flaw

The US cybersecurity agency, CISA, added a flaw in NextGen Healthcare's Mirth Connect product to its catalog of Known Exploited...
Read More
CISA ALERT  CISA Warns Exploiting NextGen Healthcare Mirth Connect Flaw

Identifying the initial breach and understanding subsequent actions is crucial in this process. Microsoft emphasizes the importance of integrating best practices for managing logs, analyzing them, and responding to incidents to stay ahead of cyber threats.

Microsoft describes a hypothetical attack scenario called “Pass the Cookie” where an attacker steals a user’s session cookie to gain unauthorized access to their account. It is important to closely monitor and analyze Azure logs to detect sophisticated attacks.

Log Analysis Techniques:

“To simplify cybersecurity challenges, Microsoft recommends utilizing Azure Log Analytics.” This tool is essential for investigating security incidents within Azure subscriptions.”

By sending both Microsoft Entra ID Audit logs and Azure Activity logs to Log Analytics, organizations can consolidate these logs in the CloudAppEvents table.

Source: Microsoft

Simultaneously, Log Analytics organizes this data into the AuditLogs and AzureActivity tables.

Microsoft provides examples of Log Analytics queries, such as hunting for Azure Role assignments to newly added guest user accounts, demonstrating the practical application of log analysis in identifying potential security threats and vulnerabilities.

Understanding the scope and complexity of threat actor actions is crucial in fortifying defenses against cyberattacks. The detailed analysis of logs enables organizations to trace attackers’ steps, from the initial breach to their movements within the Azure environment. This insight is invaluable in developing strategies to prevent future attacks and enhance the security posture of cloud subscriptions.

Check Also

trojan

New “Antidot” Banking Trojan disguised Fake Google Play Updates

The “Antidot” Android Banking Trojan pretends to be a Google Play update app and targets …

Leave a Reply

Your email address will not be published. Required fields are marked *