Hiding in the Clouds: Abusing Azure DevOps Services to Bypass Microsoft Sentinel Analytic Rules
summary
Research shows Azure DevOps Services allows trivial evasion of default Microsoft Sentinel rules: 18 built-in rules tested and several bypassed by using the user authentication cookie (valid 7-day auth cookie), nonstandard user agents, or manipulating build pipelines. An undocumented code search API exposes code secrets; pipeline secrets can be exfiltrated by string-splitting and self-hosted agents can pivot on build runs. A 35-module tool, ADOKit, is released to perform these attacks and it successfully reproduces reconnaissance, persistence and privilege escalation techniques.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 2:14Research drivers and goals
- 5:27Azure DevOps Services background
- 9:00Attacking Azure DevOps overview
- 12:25Privilege escalation and pipeline manipulation
- 17:43Defense evasion in Azure DevOps
- 20:52REST API abuse for recon and persistence
- 23:01Bypassing Sentinel rules
- 25:34Improving Sentinel rules for Azure DevOps
- 27:00Ado Kit tool and demo setup
- 28:04Demonstration with Ado Kit
- 33:24Defensive recommendations
- 35:10Takeaways and observations
- 36:14Final recommendations
- 37:39Q&A
related talks
39mHow to steal Azure DevOps secrets
49mAzure DevOps security - Lessons learned
44mAzure DevSecOps
41mUncovering Azure's Silent Threats: A Journey into Cloud Vulnerabilities
58mPrivilege Escalation in Microsoft Azure
42mAzure DevOps security - Lessons learned
52mUncovering Azure's Silent Threats: A Journey Into Cloud Vulnerabilities
51mAdvanced Attack Vectors in Azure Environments