Hiding in the Clouds: Abusing Azure DevOps Services to Bypass Microsoft Sentinel Analytic Rules

...This presentation will give a background on Azure DevOps Services, along with showing how to perform several attacks against the cloud-based platform. These attacks will include reconnaissance, privilege escalation, persistence, and defense evasion. The attacks will be shown to bypass default Microsoft Sentinel analytic rules for Azure DevOps Services. Defensive guidance will be provided on protecting against these attacks and improving the default Microsoft Sentinel analytic rules for Azure DevOps Services. Additionally, X-Force Red's Azure DevOps Services attack toolkit (ADOKit) …

abusing attacks azure bypass cloud cloud-based clouds default defense defense evasion devops escalation evasion microsoft microsoft sentinel persistence platform presentation privilege privilege escalation reconnaissance rules sentinel services