Skip to content
BreachPathAttack Path LibraryStart
AdvancedData theftAccount takeover

Azure managed identity to subscription control

A compromised Azure workload is used to assume its managed identity, whose over-broad role assignments are escalated toward control of the subscription and the data it holds.

Technologies
Azure
Entry points
Vulnerable application, Stolen credentials
Sectors
SaaS & technology, Financial services, Manufacturing…
Stages
3
01

A workload is compromised and its identity assumed

Through an application weakness or a stolen credential, the attacker gains execution in an Azure-hosted workload and uses its assigned managed identity to make authenticated calls to Azure services.

Attacker objective

Act as the workload's managed identity within Azure.

MITRE ATT&CK
Controls that should stop this
  • Least-privilege managed identities scoped to the workload's needs
  • Egress restrictions and hardened workload hosting
  • Secure development lifecycle for the application
What defenders should see
  • Managed-identity calls from unusual patterns or times
  • First-seen actions for the workload identity
  • Unexpected outbound activity from the workload
What a pentest validates
  • Application penetration test of the hosted workload
  • Review the workload identity's role assignments
  • Validate egress and hosting isolation
Business impact

The attacker holds a legitimate Azure identity belonging to the workload.

02

Over-broad role assignments are enumerated and abused

The attacker enumerates the identity's role assignments and the subscription's resources, seeking roles that permit further assignment, access to key vaults, or management of resources beyond the workload's scope.

Attacker objective

Find and exploit excessive permissions to widen access toward the subscription.

MITRE ATT&CK
Controls that should stop this
  • Remove roles that allow self-escalation (e.g. broad owner/user-access rights)
  • Separate the identity plane from data-plane secrets
  • Alerting on role-assignment changes
What defenders should see
  • Role-assignment enumeration and creation events
  • Key-vault access from a workload identity
  • Management-plane actions outside the workload's normal scope
What a pentest validates
  • Map escalation paths from the workload role to subscription control
  • Review key-vault access policies
  • Validate alerting on role-assignment changes
Business impact

The attacker gains rights approaching control of the subscription.

03

Subscription data and secrets are reached

With elevated rights, the attacker retrieves secrets from key vaults and reads from storage and databases across the subscription, then exfiltrates what is valuable.

Attacker objective

Access the data and secrets across the subscription's resources.

MITRE ATT&CK
Controls that should stop this
  • Tight key-vault access policies and secret rotation
  • Encryption and egress controls on storage and databases
  • Anomaly detection on secret and data access
What defenders should see
  • Bulk secret retrieval from key vaults
  • Anomalous storage/database read volume
  • Data egress to unfamiliar destinations
What a pentest validates
  • Test whether escalated rights reach secrets and data
  • Validate detection of bulk secret and data access
  • Confirm egress controls on subscription resources
Business impact

The data and secrets of every app in the subscription are exposed.

ATT&CK techniques in this chain

T1078.004Valid Accounts: Cloud AccountsT1190Exploit Public-Facing ApplicationT1552.001Unsecured Credentials: Credentials In FilesT1530Data from Cloud StorageT1098.003Account Manipulation: Additional Cloud RolesT1580Cloud Infrastructure Discovery

If this chain completes

Escalation from one workload to control of an Azure subscription — exposing the data, secrets and resources of every application hosted within it.

Should you test this against your environment?

Turn this chain into a scoped red-team brief — objective, systems and identities in scope, testing assumptions and the questions to answer before commissioning.

Generate my red-team test briefExplore more paths