Detecting Azure Lateral Movement
FreeIdentify and respond to lateral movement in Azure environments.
Free · Opens the source repo
What Detecting Azure Lateral Movement does
Detecting Azure Lateral Movement is a skill designed for cybersecurity professionals focused on monitoring and protecting Azure Active Directory (AD) and Entra ID environments. This skill leverages Microsoft Graph API audit logs, Azure Sentinel KQL queries, and sign-in anomaly correlation to detect unauthorized lateral movement within cloud infrastructures. Unlike traditional on-premises environments, lateral movement in Azure often involves techniques such as OAuth application consent grants and service principal abuse, necessitating a tailored approach to detection.
The skill guides users through the process of configuring log ingestion from various Azure sources, including sign-in logs and audit logs, into a Log Analytics workspace. It provides structured steps for building detection rules that focus on common lateral movement techniques like unusual service principal credential additions and cross-tenant sign-ins. By correlating low-confidence indicators, users can enhance their detection capabilities and identify potential threats more effectively.
In addition to detection, the skill also emphasizes the importance of automating responses to identified threats. Users can create Sentinel playbooks to take immediate action, such as revoking suspicious OAuth grants or disabling compromised service principals. The expected output includes detailed JSON reports that outline detected indicators, correlated events, and recommended actions, complete with mappings to the MITRE ATT&CK framework.
This skill is particularly useful for security operations center (SOC) analysts and threat hunters who need to build and validate detection rules for Azure environments. With the increasing complexity of cloud security, having a robust framework for detecting lateral movement is essential for maintaining a secure Azure infrastructure.
When to use it
Use this skill when investigating security incidents related to Azure lateral movement or when developing detection rules for Azure AD environments.
When not to use it
This skill may not be suitable for environments that do not utilize Azure AD or for those looking for general threat detection outside of Azure-specific scenarios.
What you can build with it
Investigating Security Incidents
Use this skill to analyze and respond to security incidents involving lateral movement in Azure environments.
Building Detection Rules
Create custom detection rules using KQL queries tailored for identifying Azure-specific lateral movement techniques.
Automating Security Responses
Implement automated responses to detected threats to enhance your security posture and reduce response times.
How to install Detecting Azure Lateral Movement
View source1. Install with the skills CLI
npx skills add mukul975/anthropic-cybersecurity-skills/detecting-azure-lateral-movement --agent claude-code2. Or install it manually
Download the skill folder and drop it into ~/.claude/skills/ for all projects, or .claude/skills/ to scope it to one repo. Restart Claude Code so it picks up the new skill.
Anthropic's agentic coding CLI, and the reference implementation of Agent Skills. Drop a skill folder into ~/.claude/skills and Claude Code loads it automatically whenever a task matches the skill's description. Claude Code docs
Inside SKILL.md
Written by mukul975Detecting Azure Lateral Movement
Overview
Lateral movement in Azure AD/Entra ID differs from on-premises environments. Attackers pivot through OAuth application consent grants, service principal abuse, cross-tenant access policies, and stolen refresh tokens rather than SMB/RDP connections. Detection requires correlating Microsoft Graph API audit logs, Azure AD sign-in logs, and Entra ID protection risk events using KQL queries in Microsoft Sentinel. This skill covers building detection analytics for common Azure lateral movement techniques including application impersonation, mailbox delegation abuse, and conditional access policy bypasses.
When to Use
- When investigating security incidents that require detecting azure lateral movement
- When building detection rules or threat hunting queries for this domain
- When SOC analysts need structured procedures for this analysis type
- When validating security monitoring coverage for related attack techniques
Prerequisites
- Azure subscription with Microsoft Sentinel workspace configured
- Azure AD P2 or Entra ID P2 license for risk-based sign-in detection
- Microsoft Graph API permissions: AuditLog.Read.All, Directory.Read.All, SecurityEvents.Read.All
- Log Analytics workspace ingesting AuditLogs, SigninLogs, and AADServicePrincipalSignInLogs
- Familiarity with KQL (Kusto Query Language)
Steps
Step 1: Configure Log Ingestion
Enable diagnostic settings to stream Azure AD logs to Log Analytics:
- Sign-in logs (interactive and non-interactive)
- Audit logs (directory changes, app consent)
- Service principal sign-in logs
- Provisioning logs
- Risky users and risk detections
Step 2: Build Detection Queries
Create KQL analytics rules in Sentinel for:
- Unusual service principal credential additions
- OAuth application consent grants to unknown apps
- Cross-tenant sign-ins from new tenants
- Token replay from different IP/user-agent combinations
- Mailbox delegation changes (FullAccess, SendAs)
Step 3: Correlate Events
Chain multiple low-confidence indicators into high-confidence lateral movement detections by correlating sign-in anomalies with directory changes within time windows.
Step 4: Automate Response
Create Sentinel playbooks (Logic Apps) to automatically revoke suspicious OAuth grants, disable compromised service principals, and enforce step-up authentication.
Expected Output
JSON report containing detected lateral movement indicators, correlated event chains, affected identities, and recommended containment actions with MITRE ATT&CK technique mappings.
Frequently asked questions about Detecting Azure Lateral Movement
Similar skills
Asset Criticality Scoring for Vulns
Prioritize vulnerabilities based on asset criticality.
Performing Alert Triage with Elastic SIEM
Streamline alert triage processes in Elastic Security.
Active Directory Vulnerability Assessment
Secure your Active Directory with comprehensive assessments.
Active Directory Investigation
Streamline your Active Directory compromise investigations.
Parsing Artifacts with Eric Zimmerman Tools
Efficiently parse Windows forensic artifacts for analysis.
Operationalizing MISP Threat Feeds
Enhance threat detection with curated MISP feeds.