About The Training
Berlin 2025 | Trainings
- AI Security: Terminating The Terminator
- AdversaryOps: Engineering Red Team Tradecraft
- Application Security Tool Stack - How to Discover Vulnerabilities in Software
- Building Secure Firmware: Best Practices and Labs
- Cloud Red Team Tactics for Attacking and Defending Azure
- Cyber Threat Intelligence Bootcamp: Hands-on Labs & Real-World Scenarios
- Hacking Android Applications
- Hacking Modern Web & Desktop apps: Master the Future of Attack Vectors
- Slaying the RE Dragon: Mastering Reverse Engineering
< Training Title />
Cloud Red Team Tactics for Attacking and Defending Azure
< Training Schedule />
Start Date: Mar 02, 2026
End Date: Mar 04, 2026
< Training Objectives />
More than 95 percent of Fortune 500 use Azure today! A huge number of organizations now use Entra ID as an Identity and Access Management platform using the hybrid cloud model. This makes it imperative to understand the risks associated with Azure as not only the Windows infrastructure and apps use it but also identities across an enterprise are authenticated using it.
In addition to cloud-only identity, the ability to connect on-prem Active Directory, applications and infrastructure to Azure brings some very interesting opportunities and risks too. Often complex to understand, this setup of components, infrastructure and identity is a security challenge.
This hands-on training aims towards abusing Azure and several services offered by it. We will cover multiple complex attack lifecycles against a lab containing multiple live Azure tenants.
All the phases of Azure red teaming and pentesting – Recon, Initial access, Enumeration, Privilege Escalation, Lateral Movement, Persistence and Data mining are covered. We will also discuss detecting and monitoring for the techniques we use.
The course is a mixture of fun, demos, exercises, hands-on and lecture. The training focuses more on methodology and techniques than tools.
If you are a security professional trying to improve your skills in Azure cloud security, Azure Pentesting or Red teaming the Azure cloud this is the right class for you!
Following topics are covered:
• Introduction to Azure and Entra ID
• Discovery and Recon of services and applications
• Enumeration
• Initial Access Attacks (Enterprise Apps, App Services, Function Apps, Insecure Storage, Phishing, Consent Grant Attacks, Device Code Auth Flow)
• Enumeration post authentication (Storage Accounts, Key vaults, Blobs, Automation Accounts, Deployment Templates etc.)
• Privilege Escalation (RBAC roles, Entra ID Roles, Across subscriptions)
• Lateral Movement (Pass-the-PRT, Pass-the-Certificate, Across Tenant, cloud to on-prem, on-prem to cloud)
• Lateral Movement (Across Tenant, cloud to on-prem, on-prem to cloud)
< Training Level />
Basic;Intermediate
< Training Outlines />
Day 1
- Introduction to Azure and Entra ID
- Discovery and Recon of services and applications
- Enumeration
- Initial Access Attacks (Enterprise Apps, App Services, Function Apps, Insecure Storage, Phishing, Consent Grant Attacks, Device Code Auth Flow)
Day 2
- Enumeration post authentication (Storage Accounts, Key vaults, Blobs, Automation Accounts, Deployment Templates etc.)
- Privilege Escalation (RBAC roles, Entra ID Roles, Across subscriptions)
- Lateral Movement (Pass-the-PRT, Pass-the-Certificate, Across Tenant, cloud to on-prem, on-prem to cloud)
Day 3
- Lateral Movement (Across Tenant, cloud to on-prem, on-prem to cloud)
- Persistence techniques (Hybrid Identity, Golden SAML, Service Principals, Dynamic Groups)
- Data Mining
- Bypassing Defenses (MFA, Conditional Access, Defender for Cloud)
- Defenses, Monitoring and Auditing (CAP, PIM, Microsoft Defender for Cloud, JIT, Risk policies, MFA, MTPs, Azure Sentinel)
< WHAT TO BRING? />
- System with 4 GB RAM and ability to install OpenVPN client and RDP to Windows boxes.
- Privileges to disable/change any antivirus or firewall.
< Training PREREQUISITE />
Basic understanding of Azure is desired but not mandatory.
< WHO SHOULD ATTEND? />
Red teamers and penetration testers who want to improve on their Azure attack skills should take this class. Blue teamers, Azure administrators and security professionals who want to understand the approach and techniques of adversaries should take this class.
< WHAT TO EXPECT? />
- The course helps the students in learning and understanding attacks against an organization that is using Azure by executing a full 'kill chain'/attack lifecycle.
- Students get to practice attacks on Azure in a live lab environment that has multiple Azure tenants and a large number of different resources including hybrid identity and on-prem infrastructure. We really have invested a lot in making these labs fun, stable and compliant to Microsoft directives. The lab is an Azure cloud playground and students can solve it in multiple ways.
- Students can understand the defenses available to counter the discussed attacks and analyze the footprints of the attackers!
< WHAT ATTENDEES WILL GET? />
- Attendees will get free one month access to a lab configured like an Enterprise network, during and after the training.
- An attempt to completely hands-on Certified by Altered Security Red Team Professional for Azure (CARTP)
- In addition to that, learning aid like course slides, lab manual, walk-through videos and lab support till the lab access is active
< WHAT NOT TO EXPECT? />
Azure is a huge cloud platform. We could cover only the most popular services in Azure. Please do not expect discussion on a large number of services.
< About the Trainer />
Nikhil Mittal is a hacker, infosec researcher, speaker, and enthusiast. His areas of interest include red teaming, Azure and active directory security, attack research, defense strategies, and post-exploitation research. He has 15+ years of experience in red teaming.
He specializes in assessing security risks in secure environments that require novel attack vectors and an "out of the box" approach. He has worked extensively on Azure AD, Active Directory attacks, defense, and bypassing detection mechanisms.
He has spoken/trained at conferences like DEF CON, BlackHat, BruCON, and more.
He is the founder of Altered Security - a company focusing on hands-on enterprise security learning - https://www.alteredsecurity.com/