CyberStrike · Cloud Domain · Azure
Summary
CyberStrike’s Azure cloud domain runs a two-layer assessment pipeline against Microsoft Azure environments. Layer 1 is fully deterministic: 154 programs enumerate, audit, and probe Azure resources through the ARM REST API, Microsoft Graph, and IMDS. Layer 2 is AI-driven: 13 specialist agents analyze the Layer 1 output, verify findings, chase cross-group attack paths, and produce proven, CWE-mapped vulnerabilities. On top of this, 367 CIS benchmark skills provide compliance coverage across Foundations, Compute, Database, and Storage.
The numbers
| Metric | Count |
|---|---|
| Azurehook programs (Layer 1) | 154 |
| Attack categories | 13 |
| CIS benchmark skills | 367 |
| Cloud analyst agents (Layer 2) | 9 |
| Total Layer 2 agents | 13 (9 analysts + orchestrator + followup + verify + batch-verifier) |
| Risk groups | 9 |
| CWE mappings | ~130 distinct finding-to-CWE entries |
| Azure services covered | 47+ (from VMs to Sentinel to M365) |
Layer 1: deterministic assessment (azurehook)
Layer 1 runs without any AI. The azure_assess meta-program launches 65+ recon and compliance programs in parallel with concurrency control, retry, and circuit-breaker logic. Every program calls the Azure REST API directly (ARM, Graph, IMDS) and returns structured findings with severity, CWE, and evidence.
154 programs across 13 categories
| Category | Programs | What it covers |
|---|---|---|
| Recon | 47 | Subscriptions, Entra ID, RBAC, VMs, VMSS, AKS, VNets, NSGs, DNS, ACR, Redis, Data Factory, Front Door, Container Instances, APIM, Databricks, App Insights, Monitor, Recovery Services, Intune, Graph users, app registrations, Logic Apps, Automation, Synapse, Purview, subdomain takeover, stale permissions, public exposure, Cognitive Services, IoT Hub, SignalR, Event Grid, Batch, Maps, Sentinel, VPN gateways, ExpressRoute, Private Link, Service Fabric, Static Web Apps, managed environments |
| Credential | 14 | Key Vault dump, managed identity tokens, Azure AD token manipulation (FOCI), IMDS harvest, device code phish, local token theft, certificate abuse, storage key dump, Automation cred dump, Graph token harvest, refresh token replay, runbook cred extract, kubeconfig dump, web app env dump |
| Privilege escalation | 11 | Entra privesc, custom role exploit, Conditional Access audit, PIM abuse, managed identity privesc, deployment privesc, Global Admin elevation, app admin privesc, resource hierarchy abuse, dynamic group membership abuse, partner/delegated admin abuse |
| Persistence | 11 | Runbook backdoor, Logic App backdoor, Function App backdoor, service principal persist, VM extension backdoor, webhook persist, DevOps pipeline backdoor, Lighthouse delegation, ACR image backdoor, scheduled task persist, OAuth app persist |
| Lateral movement | 10 | VM Run Command, Bastion tunnel, Arc execution, DevOps service connections, cross-tenant enum, Custom Script Extension, userdata injection, Intune deploy, MSBuild execution, Shared Image inject |
| Evasion | 11 | Diagnostic tamper, Sentinel suppress, Defender disable, activity log tamper, policy exemption, WAF bypass, alert suppress, Log Analytics tamper, NSG flow log disable, resource move, tag manipulation |
| Exfiltration | 12 | Blob storage dump, Cosmos DB dump, disk snapshot, Table/Queue dump, File Share dump, Data Lake dump, Service Bus sniff, Event Hub tap, Graph mail dump, SharePoint dump, Teams dump, VM disk download |
| Compliance | 18 | CIS-aligned: Defender plans, Defender contacts, storage security, SQL audit, PostgreSQL, MySQL, Cosmos DB, diagnostic settings, activity alerts, Network Watcher, VM security, App Service, Key Vault, identity MFA, guest access, password policy, resource locks, Azure Policy compliance |
| Identity | 10 | Federation/Golden SAML, PTA agent abuse, AADConnect dump, Seamless SSO silver ticket, SAML forge, MFA manipulation, rogue user creation, password spray, insider tenant recon, consent/OAuth phish |
| Impact | 5 | Resource hijack, data destruction, ransomware simulation, account lockout, service disruption, all assessment-only by default, require explicit execute flag |
| M365 | 4 | Exchange abuse, SharePoint enum, Teams enum, OneDrive access |
| Cleanup | 1 | Remove all CyberStrike-created Azure resources |
API surfaces
Programs target three Azure API planes:
- ARM (Azure Resource Manager): resource enumeration, RBAC, NSG rules, storage config, network topology, compliance state
- Microsoft Graph: Entra ID users/groups/apps, conditional access, PIM, Intune, mail, Teams, SharePoint
- IMDS (Instance Metadata Service): managed identity token extraction, VM metadata, network info
Safety controls
- Impact programs are gated.
resource_hijack,data_destroy,ransomware_sim,service_disruption, andvm_disk_downloadrun in assessment/dry-run mode by default. The destructive path requires an explicitexecute: trueparameter. - Cleanup is enforced.
cleanup_azureremoves all CyberStrike-created resources. The tool description instructs agents: “ALWAYS run before leaving.” - Every finding is CWE-mapped. ~130 distinct finding IDs are mapped to CWE entries in the built-in
CWE_MAP.
Layer 2: AI analysis pipeline
Layer 2 takes the structured findings from Layer 1 and applies AI reasoning: enrichment, verification, cross-group correlation, and attack-path discovery.
Agent roster
| Agent | Role |
|---|---|
| cloud-orchestrator | Dispatches Layer 2, manages phases and budget |
| cloud-analyst-identity | Entra ID, RBAC, service principals, managed identities; runs first (blocking) |
| cloud-analyst-compute | VMs, VMSS, AKS, container instances, App Services, etc. |
| cloud-analyst-network | VNets, NSGs, DNS, Front Door, VPN, ExpressRoute, Private Link |
| cloud-analyst-data | SQL, Redis, Data Factory, Synapse, Purview |
| cloud-analyst-security | Sentinel, Monitor, App Insights, Recovery Services |
| cloud-analyst-access | Intune, Logic Apps, Automation, APIM |
| cloud-analyst-specialized | ACR, Databricks, IoT Hub, SignalR, Event Grid, Batch, Maps, Cognitive Services |
| cloud-analyst-compliance | CIS Foundations Benchmark checks |
| cloud-analyst-exposure | Public resources, subdomain takeover, stale permissions, Conditional Access |
| cloud-followup | Chases cross-group chains and follow-up questions |
| cloud-verify | Re-verifies promoted findings |
| cloud-batch-verifier | Bulk-verifies remaining findings under time pressure |
Orchestration phases
idle → layer1 → identity → triage → parallel → sync → followup → verify → complete- Layer 1:
azure_assessruns all 65+ deterministic programs - Identity first: the identity analyst runs blocking, because every other group depends on who has what permissions
- Triage: findings are classified as
formulaic(straightforward) orinvestigate(needs deeper analysis) via pattern matching on severity, title, and keywords (managed identity, privilege escalation, lateral movement, credentials, etc.) - Parallel: the remaining 8 analysts run concurrently, each receiving their group’s Layer 1 findings
- Sync: results are collected, cross-group chains are detected
- Follow-up: the follow-up agent chases promising attack paths across groups
- Verify: remaining findings are batch-verified
- Complete: final deduplication, severity reconciliation
Budget controls
| Parameter | Value |
|---|---|
| Layer 2 deadline | 25 minutes |
| Follow-up reserve | 5 minutes |
| Per-agent timeout | 10 minutes |
| Findings per agent | 5 max |
| Agents per group | 4 max |
| Concurrent agents | 5 max |
| Batch verify timeout | 5 minutes |
| Follow-up timeout | 10 minutes |
| Verify timeout | 5 minutes |
| Watchdog interval | 30 seconds |
| Watchdog spawn after | 4 minutes |
Agent permissions
Every cloud analyst gets the same locked-down permission set:
bash,read,glob,grep: allowed (for inspecting cached assessment data)azurehook,awshook,kubehook,gcphook: allowed (to call back into the hook tools)add_intel,get_cloud_intel,get_cloud_groups,get_assess_findings: allowedreport_vulnerability,triage_vulnerability,update_vrt_check,methodology_status: allowedskill: allowed (analysts can invoke CIS and attack skills)todowrite,todoread,task: denied
Skills per group
Each analyst is loaded with relevant skill categories:
| Group | Skills |
|---|---|
| Identity | azure-postexploit, cloud-assessment, ad-security |
| Compute | azure-postexploit, cloud-assessment, k8s-assessment |
| Network | cloud-assessment, azure-postexploit |
| Data | azure-postexploit, cloud-assessment |
| Security | cloud-assessment, azure-postexploit |
| Access | azure-postexploit, cloud-assessment, ad-security |
| Specialized | azure-postexploit, cloud-assessment, k8s-assessment |
| Compliance | cloud-assessment, azure-postexploit, ci-assessment |
| Exposure | cloud-assessment, azure-postexploit, attack-subdomain-takeover |
The 9 risk groups
Each group owns a slice of the Azure surface. Layer 1 runs group-specific programs; Layer 2 assigns a dedicated analyst per group.
| Group | Analyst | Programs | Scope |
|---|---|---|---|
| Identity & Permissions | cloud-analyst-identity | 5 | Entra ID, RBAC, Graph users, app registrations, service principals |
| Compute | cloud-analyst-compute | 9 | VMs, VMSS, AKS, Container Instances, managed environments, Static Web Apps, Service Fabric, Batch, App Services |
| Network | cloud-analyst-network | 7 | VNets, NSGs, DNS, Front Door, VPN gateways, ExpressRoute, Private Link |
| Data Stores | cloud-analyst-data | 5 | SQL, Redis, Data Factory, Synapse, Purview |
| Security & Monitoring | cloud-analyst-security | 4 | Sentinel, Monitor, App Insights, Recovery Services |
| Identity & Access Services | cloud-analyst-access | 4 | Intune, Logic App connectors, Automation runbooks, APIM |
| Specialized Services | cloud-analyst-specialized | 8 | ACR, Databricks, IoT Hub, SignalR, Event Grid, Batch, Maps, Cognitive Services |
| CIS Compliance | cloud-analyst-compliance | 17 | Defender, storage, SQL, PostgreSQL, MySQL, Cosmos DB, diagnostics, alerts, Network Watcher, VMs, App Service, Key Vault, identity MFA, guests, passwords, locks, Policy |
| Exposure Analysis | cloud-analyst-exposure | 4 | Public resources, subdomain takeover, stale permissions, Conditional Access |
CIS compliance coverage
CyberStrike ships 367 Azure CIS benchmark skills across four domains:
| CIS Domain | Coverage |
|---|---|
| Foundations | Defender plans, security contacts, activity logs, alerts, diagnostics, MFA, guest access, passwords, resource locks, Policy |
| Compute | VM disk encryption, extensions, endpoint protection, security updates |
| Database | SQL auditing/TDE, PostgreSQL SSL/logging, MySQL SSL, Cosmos DB network/keys |
| Storage | Secure transfer, private endpoints, network rules, soft delete, blob access |
Each skill is a SKILL.md playbook the compliance analyst invokes by name. The 18 compliance programs in Layer 1 run the deterministic checks; the compliance analyst enriches and verifies them using these skills.
Finding classification
Before dispatching Layer 2 analysts, findings are classified into two buckets:
- Formulaic: straightforward issues (missing headers, default configs, informational) that an analyst confirms and documents
- Investigate: findings matching high-severity patterns that need deeper analysis: managed identities, service principals, role assignments, privilege escalation, lateral movement, credentials, Key Vault, certificates, custom roles, wildcards, network peering, VPN, ExpressRoute, subdomain takeover, public endpoints, anonymous access, runbooks, automation, Logic Apps, API keys
Critical-severity findings are always classified as investigate.
Cross-group chain detection
After all analysts complete, a dedicated chain detection pass (detectCloudChains) correlates findings across groups to identify multi-step attack paths, for example:
- Over-permissioned managed identity (identity) plus exposed IMDS (compute) leads to credential theft
- Stale RBAC assignment (exposure) plus runbook with hardcoded creds (credential) leads to lateral movement
- Public storage (exposure) plus weak Key Vault policy (data) leads to a data exfiltration path
The follow-up agent receives the detected chains and attempts to verify each one.
Deduplication and severity reconciliation
Before reporting, the orchestrator runs a deduplication fence:
- Findings are grouped by CWE + endpoint + title
- Within each group, the strongest member survives: highest severity, then most evidence
- Weaker duplicates are marked
DUPLICATEwith a pointer to the survivor - This prevents a low-severity skeleton from surviving while the critical version gets buried (#108)
Package @cyberstrike-io/azure · TypeScript/Bun · AGPL-3.0-only. Auth: Azure CLI (az) or managed identity. Runs against any subscription the authenticated principal can read. For a closer look at the Layer 1 toolkit, see Azurehook: 154 programs for Azure offense.
