Keys to the Azure Kingdom: Detecting Service Principal Abuse


Posted on in Presentations

New advanced Azure attacks (e.g. Blizzard) abuse OAuth and managed identities, which use underlying service principals to gain persistence and privilege escalation. We'll review a design-based approach to better detection and lockdown including custom roles, conditional access, signed changes, and low-FP detection rules to mitigate service principal abuse common to these rapidly evolving attacks.

Access This and Other RSAC Conference Presentations with Your Free RSAC Membership

Your RSAC Membership also includes AI-powered summaries, mind maps, and slides for Conference presentations, Group Discussions with experts, and more.

Watch Now >>
Participants
Jenko Hwong

Speaker

Threat Research, WideField Security


Share With Your Community