Microsoft Azure Cloud Threat Prevention Framework

This chapter includes a quick summary of Azure services—Azure Security Center and Azure Defender, which is Microsoft's Cloud Security Posture Management, and Azure Sentinel, which is Microsoft's cloud‐native Security Information Event Management and Security Orchestration, Automation, and Response technology. Zero Trust is a MITRE‐recommended security approach because it creates access limits that deter attacks. In the Microsoft environment, Azure Conditional Access works with the Office 365 suite of products and SaaS apps configured in Azure Active Directory. There are five primary methods attackers used to make privilege escalation work: credential exploitation, vulnerabilities and exploits, misconfigurations, malware, and social engineering. Threat actors actively hunt for accessible machines with open management ports, like RDP or SSH. Data exfiltration is a technique used by malicious actors to target, copy, and transfer sensitive data.