Attack surface detection system and method for azure cloud

Abstract

The application provides an attack surface detection system and method for Azure cloud, comprising an authentication subsystem, an information collection subsystem and a threat analysis subsystem; the authentication subsystem authenticates the Azure cloud tenant, obtains and caches the required token, and switches the token type when needed; the information collection subsystem collects information in the Azure tenant using the token, collects information in the Azure subscription using the token, and stores the collected information in the database; the threat analysis subsystem performs threat analysis and attack surface detection on the collected information. The application can be used to quickly detect the permission allocation, service configuration and defense deployment in the Azure cloud tenant, and can detect the vulnerability of the tenant from the directory configuration, data acquisition, permission promotion and permission maintenance, so as to comprehensively and accurately perform the rapid security detection and risk discovery on the Azure cloud environment.

Description

Technical Field

[0001] This invention relates to the fields of cloud computing and network security, and more specifically, to an attack surface detection system and method for Azure cloud. Background Technology

[0002] Cloud services, with their shared resource pools, pay-as-you-go nature, and lack of need for hardware maintenance and upgrades, have become the preferred choice for an increasing number of enterprises deploying applications. Microsoft Azure, one of the world's most mainstream public cloud platforms, has evolved into a comprehensive cloud platform based on domain environment management, providing a range of cloud services including computing, storage, machine learning, IoT, and application deployment. Public cloud security has become a major focus of attack and defense efforts. The vast majority of security incidents originate from various misconfigurations within tenants. Therefore, comprehensively and accurately checking and assessing tenant security has become a significant challenge. Currently, only some small tools exist that can detect the security of specific services within Azure cloud tenants; a method and system capable of comprehensively and accurately detecting the attack surface of Azure cloud tenants and assessing their security has yet to emerge. Summary of the Invention

[0003] In view of the deficiencies in the prior art, the purpose of this invention is to provide an attack surface detection system and method for Azure cloud.

[0004] An attack surface detection system for Azure cloud provided by the present invention includes: an authentication subsystem, an information collection subsystem, and a threat analysis subsystem;

[0005] The authentication subsystem authenticates Azure cloud tenants, obtains and caches the required tokens, and switches token types when needed;

[0006] The information collection subsystem uses tokens to collect information from Azure tenants and Azure subscriptions, and stores the collected information in a database.

[0007] The threat analysis subsystem performs threat analysis and attack surface detection on the collected information.

[0008] Preferably, the authentication subsystem includes:

[0009] Login module: Receives user credentials input, logs into Azure cloud via interactive login or device code stream method and obtains access token and refresh token, which are then stored in the token cache;

[0010] Token Management Module: Manages and provides a token cache, and uses refresh tokens to exchange for different access tokens based on the needs of other subsystems.

[0011] Preferably, the information collection subsystem includes:

[0012] Azure AD Information Collection Module: Collects information on users, groups, service principals, role assignments, MFA configurations, and conditional access policies in Azure AD via the AAD Graph API or Microsoft Graph API.

[0013] Azure subscription information collection module: Collects role assignments, service configurations, and defense deployment information in Azure subscriptions via the ARM API.

[0014] Preferably, the threat analysis subsystem includes:

[0015] Credential Configuration Risk Analysis Module: Analyzes the relationships between all users, groups, and service entities, and combines role assignments to determine the actual permission scope of each directory object. It then classifies directory objects with different permission scopes into different levels and analyzes whether the MFA configuration and conditional access policies of each leveled directory object are compliant.

[0016] Privilege Escalation Risk Analysis Module: Based on specific privilege escalation judgment strategies, this module examines all possible privilege escalation points within a tenant and provides a risk assessment.

[0017] Data Acquisition Risk Analysis Module: Based on the results of the permission escalation risk analysis, it generates a relationship diagram of the access permissions of all directory objects to various core data services and provides a risk assessment.

[0018] Access Control Risk Analysis Module: Based on a specific access control determination strategy, this module examines all possible access control points within a tenant and provides a risk assessment.

[0019] Attack path analysis module: Based on the analysis results of the first four modules, it generates a graph of possible attack paths and provides a risk assessment;

[0020] Defense Deployment Risk Analysis Module: Based on the operational status of various protection services in the Azure cloud, this module provides a risk assessment of the current defense deployment.

[0021] Assessment report generation module: Generates a threat assessment report based on the analysis results of each module in the threat analysis subsystem.

[0022] An attack surface detection method for Azure cloud provided by the present invention includes:

[0023] Step S1: The authentication subsystem obtains and exchanges tokens by performing authentication with the Azure cloud;

[0024] Step S2: The information collection subsystem uses tokens provided by the token management module to collect information on users, groups, service principals, role assignments, MFA configurations, and conditional access policies in Azure AD via the AAD Graph API or Microsoft Graph API; and collects information on role assignments, service configurations, and defense deployments in Azure subscriptions via the ARM API.

[0025] Step S3: The threat analysis subsystem detects the attack surface and risks in the current Azure tenant based on the information collected in the database and according to the credential configuration risk analysis method, privilege escalation risk analysis method, data acquisition risk analysis method, and privilege maintenance risk analysis method; it also predicts possible attack paths based on the results of the attack path analysis algorithm, and finally evaluates the current tenant's protection status based on the defense deployment risk analysis method.

[0026] Preferably, the credential configuration risk analysis method includes analyzing the relationships between all users, groups, and service entities based on information in the database, and determining the actual permission scope of each directory object in conjunction with role allocation. Directory objects with different permission scopes are classified, and for each classified directory object, its MFA configuration and conditional access policy are analyzed to determine whether they are compliant.

[0027] Preferably, the privilege escalation risk analysis method includes analyzing the potential privilege escalation attack surface by examining Runbook scripts, managed identifiers, CloudShell image contamination, run commands, and specific service entity credentials.

[0028] Preferably, the data acquisition risk analysis method includes analyzing potential data acquisition attack surfaces by examining the access and configuration of automated account assets, disks, KeyVault, storage accounts, application services, and database core data services.

[0029] Preferably, the permission maintenance risk analysis method includes analyzing potential permission maintenance attack surfaces by examining Webhook backdoors, service subject certificate storage, B2B collaboration, and the number of service subject credentials.

[0030] Preferably, the defense deployment risk analysis method includes assessing the current tenant's protection status by analyzing the running configuration of Microsoft Defender For Cloud and Microsoft Sentinel.

[0031] Compared with the prior art, the present invention has the following beneficial effects:

[0032] 1. This invention can quickly detect the permission allocation, service configuration and defense deployment status in Azure cloud tenants. It can detect the tenant's vulnerabilities from several levels, including directory configuration, data acquisition, permission escalation and permission maintenance, so as to conduct rapid security detection and risk discovery of Azure cloud environment in a more comprehensive and accurate manner.

[0033] 2. This invention can be used to comprehensively and accurately detect the attack surface in the Azure cloud. First, it utilizes Azure cloud APIs such as AADGraph, Microsoft Graph, and ARM to comprehensively collect information on users, groups, service subjects, role assignments, MFA configurations, conditional access policies, service configurations, and defense deployments in Azure AD and subscriptions. Second, it constructs a risk detection rule base from four levels: credential configuration, privilege escalation, data acquisition, and privilege maintenance, enabling analysis of potential vulnerabilities at each level within the tenant. Third, based on the vulnerabilities at each level, it constructs a relationship graph between directory objects and resource objects, presenting possible attack paths. Finally, based on the defense deployment risk analysis rules, it assesses the current tenant's protection status. Attached Figure Description

[0034] Other features, objects, and advantages of the present invention will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings:

[0035] Figure 1 This is a structural diagram of the attack surface detection system for Azure cloud provided in this embodiment of the invention;

[0036] Figure 2 This is a flowchart of an attack surface detection method for Azure cloud provided in an embodiment of the present invention. Detailed Implementation

[0037] The present invention will now be described in detail with reference to specific embodiments. These embodiments will help those skilled in the art to further understand the present invention, but do not limit the invention in any way. It should be noted that those skilled in the art can make several changes and improvements without departing from the concept of the present invention. These all fall within the protection scope of the present invention.

[0038] A preferred embodiment of the present invention provides a structural diagram of an attack surface detection system for Azure cloud, as shown below. Figure 1As shown, the attack surface detection system for Azure cloud of this invention consists of multiple subsystems, including: an authentication subsystem, an information collection subsystem, and a threat analysis subsystem. These subsystems execute tasks sequentially by passing data between each other. The authentication subsystem performs authentication for Azure cloud tenants, acquires and caches the required tokens, and switches token types as needed. The information collection subsystem uses tokens to collect information from Azure tenants, including users, groups, service principals, role assignments, MFA configurations, conditional access policies, etc., in Azure Active Directory; it also uses tokens to collect information from Azure subscriptions, including role assignments, service configurations, defense deployments, etc. The collected information is stored in a database. The threat analysis subsystem performs threat analysis and attack surface detection on the collected information and generates a threat assessment report.

[0039] The following section provides further explanation of each subsystem in the attack surface detection system for Azure cloud.

[0040] The authentication subsystem in the attack surface detection system for Azure cloud includes:

[0041] Login module: Receives user credentials input, logs into the Azure cloud through interactive login, device code stream, or other methods, and obtains access tokens and refresh tokens, which are then stored in the token cache.

[0042] Token Management Module: Manages and provides a token cache, and uses refresh tokens to exchange for different access tokens based on the needs of other subsystems.

[0043] The information collection subsystem includes:

[0044] Azure AD Information Collection Module: Collects information such as users, groups, service subjects, role assignments, MFA configurations, and conditional access policies in Azure AD through the AAD Graph API or Microsoft Graph API.

[0045] Azure subscription information collection module: Collects information such as role assignments, service configurations, and defense deployments in Azure subscriptions via the ARM API.

[0046] The threat analysis subsystem includes:

[0047] Credential Configuration Risk Analysis Module: Analyzes the relationships between all users, groups, and service entities, and combines role assignments to determine the actual permission scope of each directory object. It then classifies directory objects with different permission scopes into different levels and analyzes whether the MFA configuration and conditional access policies of each leveled directory object are compliant.

[0048] Privilege Escalation Risk Analysis Module: Based on specific privilege escalation judgment strategies, this module examines all possible privilege escalation points within a tenant and provides a risk assessment.

[0049] Data Acquisition Risk Analysis Module: Based on the results of the permission escalation risk analysis, it generates a relationship diagram of the access permissions of all directory objects to various core data services and provides a risk assessment.

[0050] Access Control Risk Analysis Module: Based on a specific access control determination strategy, this module examines all possible access control points within a tenant and provides a risk assessment.

[0051] Attack Path Analysis Module: Based on the analysis results of the first four modules, it generates a graph of possible attack paths and provides a risk assessment.

[0052] Defense Deployment Risk Analysis Module: Based on the operational status of various protection services in the Azure cloud, this module provides a risk assessment of the current defense deployment.

[0053] Assessment report generation module: Generates a threat assessment report based on the analysis results of each module in the threat analysis subsystem.

[0054] Furthermore, the flowchart of the attack surface detection method for Azure cloud provided in the preferred embodiment of the present invention is as follows: Figure 2 As shown. The specific process of the method is as follows:

[0055] Step S1: The authentication subsystem obtains and exchanges tokens by performing authentication with the Azure cloud. Preferably, through the login module, the user enters the administrator's account credentials to obtain access tokens and refresh tokens from the Azure cloud via interactive login or device code stream.

[0056] Step S2: The information collection subsystem uses tokens provided by the token management module to collect information such as users, groups, service principals, role assignments, MFA configurations, and conditional access policies in Azure AD via the AAD Graph API or Microsoft Graph API; and collects information such as role assignments, service configurations, and defense deployments in Azure subscriptions via the ARM API. The collected information is then stored in a database.

[0057] Step S3: Based on the information collected from the database, the threat analysis subsystem uses its various modules to detect the attack surface and risks present in the current Azure tenant at various levels. The specific workflow is as follows:

[0058] Step S3.1: The credential configuration risk analysis module analyzes the relationships between all users, groups, and service entities based on the information in the database, and determines the actual permission scope of each directory object in combination with role allocation. The module then classifies directory objects with different permission scopes and analyzes whether the MFA configuration and conditional access policies of each classified directory object are compliant.

[0059] In a preferred embodiment, the credential configuration risk analysis module establishes the inclusion relationship between users, service entities, and groups, as well as the mapping relationship with role assignments, to indicate the actual permission scope of each directory object and classify them according to permission level. Users are then divided into three levels according to permission level: Level 1 is high-privileged users, referring to users with permissions related to permission allocation or full write permissions to directory objects, such as managing service entities, managing users, or managing role assignments. The algorithm checks whether Level 1 users have applied relatively strict credential protection measures, including mandatory MFA, enabling conditional access policies, and a session and token lifecycle of no more than 30 days; Level 2 is general-privileged users, referring to users with privileges other than Level 1 users. The algorithm checks whether Level 2 users have applied generally strict credential protection measures, including mandatory MFA, and a session and token lifecycle of no more than 60 days; Level 3 is ordinary users, referring to users with only reader permissions or non-privileged permissions. The algorithm recommends that these users enable MFA and apply a session and token lifecycle of more than 90 days. The algorithm also checks users who are inactive for a long time and service entities that have configured more password credentials than normally used, and suggests measures to be taken against these objects.

[0060] Step S3.2: The privilege escalation risk analysis module checks all possible privilege escalation points in the tenant according to the specific privilege escalation judgment strategy and provides a risk assessment.

[0061] In a preferred embodiment, the privilege escalation risk analysis module analyzes potential privilege escalation attack surfaces by examining Runbook scripts, managed identifiers, CloudShell image contamination, run commands, and specific service principal credentials. This method detects whether directory objects possess the following characteristics:

[0062] (1) Runbook can be executed in an automation account with permissions greater than those of the directory object;

[0063] (2) A service instance with a managed identifier that has write permissions greater than those of the directory object;

[0064] (3) The storage account where the CloudShell image resides and has access permissions greater than those of the directory object;

[0065] (4) It can execute run commands in a virtual machine with permissions greater than those of the directory object;

[0066] (5) It can add credentials to service subjects with permissions greater than that of the directory object.

[0067] If at least one of these rules is met, the site is identified as a potential privilege escalation risk.

[0068] Step S3.3, the data acquisition risk analysis module generates a relationship diagram of access permissions of all directory objects to various core data services based on the results of the permission escalation risk analysis, and provides a risk assessment;

[0069] In a preferred embodiment, the data acquisition risk analysis module analyzes potential data acquisition attack surfaces by examining the access and configuration of core data services such as automated account assets, disks, KeyVault, storage accounts, application services, and databases. Based on the analysis results of the credential configuration risk analysis method and the privilege escalation risk analysis method, this method determines a list of directory objects that can actually access each core data service, and marks directory objects that have gained access through indirect privilege escalation, warning them of the potential for unauthorized data access. This method also detects the following risks:

[0070] (1) Has KeyVault been configured with a separate access control policy?

[0071] (2) Whether the public containers in the storage account contain sensitive files that may be credentials;

[0072] (3) Does the automation account contain a Runbook script that exports the assets of the automation account separately?

[0073] Step S3.4, the permission maintenance risk analysis module checks all possible permission maintenance points in the tenant according to the specific permission maintenance judgment strategy and provides a risk assessment;

[0074] In a preferred embodiment, the privilege escalation risk analysis module analyzes potential privilege escalation attack surfaces by examining webhook backdoors, service principal certificate storage, and the number of B2B collaboration and service principal credentials. This method detects privilege escalation risks using the following rules:

[0075] (1) Retrieve all Webhook instances, analyze their associated Runbook code, and determine whether they have backdoor properties;

[0076] (2) Check whether the automation account uses a RunAs certificate for authentication;

[0077] (3) List users who have enabled B2B collaboration and attached external identifiers, and determine whether they have high privileges;

[0078] (4) Retrieve the credential configuration of all service entities and determine whether the number of credentials they possess exceeds the normal value;

[0079] (5) Check whether the first-party application has been configured with a password or certificate credentials.

[0080] Step S3.5, Attack Path Analysis Module: Based on the analysis results of the first four modules, generate a possible attack path diagram and provide a risk assessment.

[0081] In a preferred embodiment, the attack path analysis module generates a relationship graph between each directory object and resource object by combining the analysis results of credential configuration risk analysis, privilege escalation risk analysis, data acquisition risk analysis, and privilege maintenance risk analysis methods, thereby deriving possible attack paths. This method first generates a relationship graph between directory objects and resource objects for the entire Azure tenant based on the directory object relationships established in the credential configuration risk analysis method, combined with role assignment information in the subscription. Then, based on the results of the privilege escalation risk analysis method, it adds lateral movement attack paths to the relationship graph. Next, based on the results of the data acquisition risk analysis and privilege maintenance risk analysis methods, it marks unauthorized data acquisition and privilege maintenance risk points in the relationship graph. After completing the above process, the method analyzes each possible attack path that can escalate from non-privileged to privileged and gain access to core data services, providing the potential damage a tenant might suffer after being attacked.

[0082] Step S3.6, the defense deployment risk analysis module, provides a risk assessment of the current defense deployment based on the operational status of various protection services in the Azure cloud;

[0083] In a preferred embodiment, the defense deployment risk analysis module assesses the current tenant's protection status by analyzing the operational configurations of Microsoft Defender and Microsoft Sentinel. This method first retrieves all license information within the current tenant, verifies the Microsoft Defender license level and validity period, and then checks whether various monitoring configurations in Microsoft Defender for Cloud are enabled. Based on the resource deployment status within the current tenant, the method checks the Microsoft Sentinel data connector configuration and analysis rules, and provides appropriate rule template suggestions.

[0084] Step S4: The report output module, based on the analysis and detection results from other modules of the threat analysis subsystem, outputs a threat assessment report of the current Azure cloud tenant's attack surface in a specified format. The output report includes:

[0085] (1) The tenant's current risk level;

[0086] (2) Directory object relationship diagram of tenants;

[0087] (3) The actual permission list of the tenant's directory object;

[0088] (4) Risk assessment of tenant's credential configuration;

[0089] (5) Risk assessment of tenant privilege escalation;

[0090] (6) Risk assessment of tenants' data acquisition;

[0091] (7) Risk assessment of tenant access maintenance;

[0092] (8) Potential attack path diagram of the tenant;

[0093] (9) Risk assessment of tenant's defense deployment;

[0094] (10) Security configuration recommendations for tenants.

[0095] Specific embodiments of the present invention have been described above. It should be understood that the present invention is not limited to the specific embodiments described above, and those skilled in the art can make various changes or modifications within the scope of the claims, which do not affect the essence of the present invention. Unless otherwise specified, the embodiments and features described in this application can be arbitrarily combined with each other.

Claims

1. An attack surface detection system for Azure cloud, characterized in that, include: Identity verification subsystem, information collection subsystem, and threat analysis subsystem; The authentication subsystem authenticates Azure cloud tenants, obtains and caches the required tokens, and switches token types when needed; The information collection subsystem uses tokens to collect information from Azure tenants and Azure subscriptions, and stores the collected information in a database. The threat analysis subsystem performs threat analysis and attack surface detection on the collected information; The threat analysis subsystem includes: Credential Configuration Risk Analysis Module: Analyzes the relationships between all users, groups, and service entities, and combines role assignments to determine the actual permission scope of each directory object. It then classifies directory objects with different permission scopes into different levels and analyzes whether the MFA configuration and conditional access policies of each leveled directory object are compliant. Privilege Escalation Risk Analysis Module: Based on specific privilege escalation judgment strategies, this module examines all possible privilege escalation points within a tenant and provides a risk assessment. Specific privilege escalation judgment strategies include analyzing potential privilege escalation attack surfaces by examining Runbook scripts, managed identifiers, CloudShell image pollution, run commands, and specific service principal credentials. Data Acquisition Risk Analysis Module: Based on the results of the permission escalation risk analysis, it generates a relationship diagram of the access permissions of all directory objects to various core data services and provides a risk assessment. The permission maintenance risk analysis module examines all possible permission maintenance points in a tenant based on specific permission maintenance judgment strategies and provides a risk assessment. Specific permission maintenance judgment strategies include analyzing potential permission maintenance attack surfaces by examining Webhook backdoors, service subject certificate storage, B2B collaboration, and the number of service subject credentials. Attack path analysis module: Based on the analysis results of the first four modules, it generates a graph of possible attack paths and provides a risk assessment; Defense Deployment Risk Analysis Module: Based on the operational status of various protection services in the Azure cloud, this module provides a risk assessment of the current defense deployment. Assessment report generation module: Generates a threat assessment report based on the analysis results of each module in the threat analysis subsystem.

2. The attack surface detection system for Azure cloud according to claim 1, characterized in that, The authentication subsystem includes: Login module: Receives user credentials input, logs into Azure cloud via interactive login or device code stream method and obtains access token and refresh token, which are then stored in the token cache; Token Management Module: Manages and provides a token cache, and uses refresh tokens to exchange for different access tokens based on the needs of other subsystems.

3. The attack surface detection system for Azure cloud according to claim 1, characterized in that, The information collection subsystem includes: Azure AD Information Collection Module: Collects information on users, groups, service principals, role assignments, MFA configurations, and conditional access policies in Azure AD via the AAD Graph API or Microsoft Graph API. Azure subscription information collection module: Collects role assignments, service configurations, and defense deployment information in Azure subscriptions via the ARM API.

4. An attack surface detection method for Azure cloud, based on the attack surface detection system for Azure cloud according to any one of claims 1-3, characterized in that, include: Step S1: The authentication subsystem obtains and exchanges tokens by performing authentication with the Azure cloud; Step S2: The information collection subsystem uses tokens provided by the token management module to collect information on users, groups, service principals, role assignments, MFA configurations, and conditional access policies in Azure AD via the AAD Graph API or Microsoft Graph API; and collects information on role assignments, service configurations, and defense deployments in Azure subscriptions via the ARM API. Step S3: The threat analysis subsystem detects the attack surface and risks in the current Azure tenant based on the information collected in the database and according to the credential configuration risk analysis method, privilege escalation risk analysis method, data acquisition risk analysis method, and privilege maintenance risk analysis method; it also predicts possible attack paths based on the results of the attack path analysis algorithm, and finally evaluates the current tenant's protection status based on the defense deployment risk analysis method.

5. The attack surface detection method for Azure cloud according to claim 4, characterized in that, The credential configuration risk analysis method includes analyzing the relationships between all users, groups, and service entities based on information in the database, and combining role allocation to determine the actual permission scope of each directory object. Directory objects with different permission scopes are classified, and for each classified directory object, its MFA configuration and conditional access policy are analyzed to determine whether they are compliant.

6. The attack surface detection method for Azure cloud according to claim 4, characterized in that, The privilege escalation risk analysis method includes analyzing the potential privilege escalation attack surface by examining Runbook scripts, managed identifiers, CloudShell image pollution, run commands, and specific service entity credentials.

7. The attack surface detection method for Azure cloud according to claim 4, characterized in that, The data acquisition risk analysis method includes analyzing potential data acquisition attack surfaces by examining the access and configuration of automated account assets, disks, KeyVault, storage accounts, application services, and core database data services.

8. The attack surface detection method for Azure cloud according to claim 4, characterized in that, The privilege servicing risk analysis method includes analyzing potential privilege servicing attack surfaces by examining Webhook backdoors, service entity certificate storage, B2B collaboration, and the number of service entity credentials.

9. The attack surface detection method for Azure cloud according to claim 4, characterized in that, The aforementioned defense deployment risk analysis method includes assessing the current tenant's protection status by analyzing the runtime configuration of Microsoft Defender for Cloud and Microsoft Sentinel.

Images