Cloud Incident ResponseAzure
Azure and Entra ID split logging between the identity plane (Entra sign-in and audit logs, on by default but only 7-30 days unless routed to Log Analytics) and the resource plane (almost everything else needs a Diagnostic Setting to exist at all). The Activity Log covers control-plane operations for 90 days. For M365, the Unified Audit Log is the backbone. Watch for diagnostic-setting changes that redirect or drop logs.
Cheat sheet by domain
Status: Enabled by default Partial / mixed OFF - must enable
| Domain | What is included | Key logs | On by default? | How to obtain | Example ATT&CK |
|---|---|---|---|---|---|
| Identity & Access | Human + non-human identities, sign-in / authentication, MFA, federation & SSO trust, role/permission grants, OAuth app consent, token & session activity. Covers credential/session revocation and non-human identity (NHI) inventory. |
| Enabled by default | Sign-in & Audit logs ON but 30d only - request read-only Log Analytics or export securely. Route to Log Analytics for >30d. Revoke: Revoke-AzureADUserAllRefreshToken (or Graph Invoke-MgInvalidateUserRefreshToken) + disable user; remove OAuth consent (az ad app permission delete). | T1110.003 Password Spraying (AZT202), T1556 Modify Auth Process, T1098.005 Device Registration, T1548.005 Temp Elevated Cloud Access, T1606.002 SAML Tokens |
| Control Plane & Management Activity | All management-plane API activity (Console/GUI, CLI, SDK). Audit-log architecture, log-tampering & immutability, resource/config changes, org-policy and tenant hierarchy changes, service enumeration. |
| Enabled by default | Activity Logs ON (90d) - request read-only Log Analytics or export. Read activity NOT logged by default. Watch Diagnostic-Setting destination changes (log redirection). Defender for Cloud/Sentinel if licensed. | T1562.008 Disable Cloud Logs, T1526 Cloud Service Discovery, T1484.002 Trust Modification, T1651 Cloud Admin Command, T1538 Cloud Service Dashboard |
| Workloads & Runtime | Compute & runtime: VMs, serverless, containers/Kubernetes. Instance metadata (IMDS) access, runtime threat detection, image trust, cryptojacking / resource hijacking, lateral movement to hosts. |
| OFF - must enable | Monitor Agent, AKS audit & Defender for Containers require enable/route to Log Analytics. Ask client to export a snapshot or attach disk to forensic VM. Watch RunCommand (AZT301.1) & VM Disk SAS URI (AZT701.1). | T1496.001 Compute Hijacking, T1059.009 Cloud API (RunCommand), T1552.005 Cloud Instance Metadata API, T1578 Modify Cloud Compute Infra, T1648 Serverless Execution |
| Network & Connectivity | Ingress/egress & lateral traffic: VPC flows, DNS, load balancers, WAF, firewall rules. Edge exploitation, C2/tunnelling, DDoS, exfil-over-network detection. |
| OFF - must enable | NSG Flow, DNS query, Firewall & App Gateway logs are OFF - ask client to enable & export or grant Log Analytics read. Watch NSG rule opening 0.0.0.0/0 to admin ports. | T1190 Exploit Public-Facing App (AZT101/102), T1048 Exfil Alt Protocol, T1071 App Layer Protocol (network/endpoint technique - outside Cloud matrix), T1498 Network DoS, T1046 Network Service Discovery |
| Data Services & Storage | Object/blob storage, databases, data warehouses, key-management. Data-plane (object-level) logging, cross-account shares, snapshots, immutable backups, mass-read / ransomware / destruction. |
| OFF - must enable | Storage & Key Vault diagnostics OFF (need Diagnostic Settings) - request client enable & export StorageRead logs. Watch SAS URI generation (AZT701) & Storage Account File Share SAS (AZT701.2). | T1530 Data from Cloud Storage (AZT701 SAS URI), T1619 Storage Object Discovery, T1537 Transfer Data to Cloud Account, T1485 Data Destruction, T1486 Data Encrypted for Impact |
| DevSecOps & Pipelines | CI/CD pipelines, source repos, artifact registries, secrets in build. OIDC/federated build identities, supply-chain & dependency tampering, malicious workflow, pipeline secret theft. |
| Partial / mixed | DevOps audit ON (90d) - request read or export; extend via Log Analytics. Revoke OIDC federated credential (az ad app federated-credential delete); rotate PAT/SP secrets. Watch workflow file changes. | T1195 Supply Chain Compromise, T1677 Poisoned Pipeline Execution, T1552.001 Credentials In Files, T1213.003 Code Repositories, T1528 Steal Application Access Token |
| SaaS & Collaboration Platforms | SaaS & collaboration: M365 / Google Workspace / Okta / GitHub org. Mailbox & file audit, OAuth-app abuse, inbox/forwarding rules, refresh-token replay, helpdesk-reset abuse. |
| Partial / mixed | UAL ON (180d std / 1y premium); per-mailbox audit needs enable. Request read-only Log Analytics/Purview or export. Revoke refresh tokens; remove inbox rule (Remove-InboxRule); pull OAuth consent. | T1114 Email Collection, T1564.008 Email Hiding Rules, T1098.002 Additional Email Delegate Perms, T1550.001 App Access Token (AZT203/405), T1671 Cloud App Integration |
| AI/ML Services | Managed AI/ML: model invocation, training-data buckets, inference endpoints, guardrails. Model/data exfil, prompt injection, abuse of stolen API keys (detect via cost anomalies), poisoning. |
| OFF - must enable | OpenAI audit OFF - request Diagnostic Settings enable & export. Cost Management ON (13-month). Revoke on invoke spike; watch new OAuth grant for cognitiveservices.*; audit training-data blob reads. | T1496.004 Cloud Service Hijacking, T1657 Financial Theft, T1530 Data from Cloud Storage, T1567 Exfil Over Web Service; MITRE ATLAS AML.T0019, OWASP LLM01 Prompt Injection |
Threat matrix
Adversary behaviours most relevant to each domain, and the log that first reveals them. Cross-check IDs against the live ATT&CK Cloud matrices.
| Domain | Example adversary behaviours (ATT&CK) | Primary detection log |
|---|---|---|
| Identity & Access | T1110.003 Password Spraying (AZT202), T1556 Modify Auth Process, T1098.005 Device Registration, T1548.005 Temp Elevated Cloud Access, T1606.002 SAML Tokens | Entra Sign-in logs (interactive, non-interactive, SP, managed-id) |
| Control Plane & Management Activity | T1562.008 Disable Cloud Logs, T1526 Cloud Service Discovery, T1484.002 Trust Modification, T1651 Cloud Admin Command, T1538 Cloud Service Dashboard | Activity Logs (management API calls) |
| Workloads & Runtime | T1496.001 Compute Hijacking, T1059.009 Cloud API (RunCommand), T1552.005 Cloud Instance Metadata API, T1578 Modify Cloud Compute Infra, T1648 Serverless Execution | Azure Monitor Agent (VM logs) |
| Network & Connectivity | T1190 Exploit Public-Facing App (AZT101/102), T1048 Exfil Alt Protocol, T1071 App Layer Protocol (network/endpoint technique - outside Cloud matrix), T1498 Network DoS, T1046 Network Service Discovery | NSG Flow Logs (NetFlow) |
| Data Services & Storage | T1530 Data from Cloud Storage (AZT701 SAS URI), T1619 Storage Object Discovery, T1537 Transfer Data to Cloud Account, T1485 Data Destruction, T1486 Data Encrypted for Impact | Storage diagnostics (blob read/write/delete) |
| DevSecOps & Pipelines | T1195 Supply Chain Compromise, T1677 Poisoned Pipeline Execution, T1552.001 Credentials In Files, T1213.003 Code Repositories, T1528 Steal Application Access Token | Azure DevOps audit log (push, PAT, policy) |
| SaaS & Collaboration Platforms | T1114 Email Collection, T1564.008 Email Hiding Rules, T1098.002 Additional Email Delegate Perms, T1550.001 App Access Token (AZT203/405), T1671 Cloud App Integration | M365 Unified Audit Log (UAL) |
| AI/ML Services | T1496.004 Cloud Service Hijacking, T1657 Financial Theft, T1530 Data from Cloud Storage, T1567 Exfil Over Web Service; MITRE ATLAS AML.T0019, OWASP LLM01 Prompt Injection | Azure OpenAI audit (Diagnostic Settings) |
Incident response plan
- Get read-only access (Reader + Security Reader); confirm the tenant and subscriptions in scope.
- Check logging posture: are Diagnostic Settings routing to Log Analytics, is the Activity Log retained, is UAL on.
- Preserve now: export Entra sign-in/audit logs and UAL; snapshot affected disks; capture Defender alerts.
- Scope identity: review Entra sign-ins (incl. non-interactive/SP/MI), OAuth consent grants, Conditional Access, PIM.
- Contain: Revoke-AzureADUserAllRefreshToken (or Graph: Invoke-MgInvalidateUserRefreshToken), disable the account, remove malicious OAuth apps and inbox rules, rotate SP secrets.
- Recover and harden: route diagnostics to Log Analytics, require MFA, review federation/trust and app permissions.
Historical incidents & TTPs
Publicly-reported incidents and techniques. Attribution reflects vendor/government assessments; some entries are disclosed vulnerabilities or SaaS/OAuth cases rather than platform-native breaches.
Storm-05582023
China-attributed actor used an acquired MSA consumer signing key plus a token-validation flaw to forge tokens and read Exchange Online mailboxes of ~25 orgs. The CSRB called it preventable.
T1606.002T1550.001T1528T1114.002Midnight Blizzard / APT292023-2024
Password spray hit a legacy no-MFA test tenant; the actor then abused a legacy OAuth app with full mailbox access and created new malicious consent grants to read leadership mailboxes.
T1110.003T1078.004T1098.003T1550.001T1114.002SolarWinds / Nobelium (Golden SAML)2020
After SUNBURST, the SVR-attributed actor stole AD FS token-signing keys and forged SAML tokens to impersonate any user into M365, bypassing MFA and leaving no AD FS auth event.
T1606.002T1552.004T1550.001T1484.002T1195.002Storm-2372 device-code phishing2024-2025
Fake Teams invites lure users into completing a legitimate OAuth device-code flow on the attacker's code, capturing valid tokens; a device is then registered to mint a Primary Refresh Token.
T1566T1528T1550.001T1098.005Peach Sandstorm / APT332023
Large-scale password spray against high-value targets, followed by cloud recon (AzureHound) and persistence via new Azure subscriptions and custom implants.
T1110.003T1078.004T1087.004T1136.003