<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Azure Lateral Movement — API Reference

## Azure CLI Commands

### Identity Enumeration

```bash
# List VMs with managed identities
az vm list --query "[?identity != null].{name:name, identity:identity.type}" -o table

# List App Services with managed identities
az webapp list --query "[?identity != null].{name:name, identity:identity.type}" -o table

# List all service principals
az ad sp list --all --query "[].{appId:appId, displayName:displayName}" -o table

# List service principal credentials
az ad sp credential list --id SP_OBJECT_ID

# List role assignments
az role assignment list --all -o table
az role assignment list --assignee PRINCIPAL_ID
az role assignment list --scope "/subscriptions/SUB_ID"
```

### Activity Monitoring

```bash
# Activity log for role changes
az monitor activity-log list --start-time START \
  --query "[?authorization.action=='Microsoft.Authorization/roleAssignments/write']"

# Sign-in logs (requires Entra ID P1)
az rest --method GET --url "https://graph.microsoft.com/v1.0/auditLogs/signIns?\$filter=createdDateTime gt START"

# Audit logs
az rest --method GET --url "https://graph.microsoft.com/v1.0/auditLogs/directoryAudits?\$filter=activityDateTime gt START"
```

### Sentinel / KQL

```kql
-- Cross-subscription activity
AzureActivity
| summarize Subscriptions=dcount(SubscriptionId) by Caller
| where Subscriptions > 2

-- Anomalous Key Vault access
AzureDiagnostics
| where ResourceType == "VAULTS" and OperationName == "SecretGet"
| summarize count() by CallerIPAddress, bin(TimeGenerated, 1h)
| where count_ > 20

-- New role assignments
AzureActivity
| where OperationNameValue == "Microsoft.Authorization/roleAssignments/write"
| where ActivityStatusValue == "Success"
```

### Defender for Cloud

```bash
# List security alerts
az security alert list --query "[?alertType contains 'LateralMovement']"

# List security recommendations
az security assessment list --query "[?status.code=='Unhealthy']" -o table
```

## Key Azure Lateral Movement Vectors

| Vector | Detection Source | KQL Table |
|--------|-----------------|-----------|
| Managed identity token theft | AzureActivity | AzureActivity |
| SP credential abuse | SigninLogs | SigninLogs |
| Cross-sub RBAC pivot | AzureActivity | AzureActivity |
| Key Vault secret access | AzureDiagnostics | AzureDiagnostics |
| Automation RunAs abuse | AzureActivity | AzureActivity |
| Storage account key use | StorageBlobLogs | StorageBlobLogs |
