New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Azure execution through serial console #410

Open

christophetd opened this issue Sep 15, 2023 · 0 comments

Labels

kind/new-technique platform/azure

Contributor

christophetd commented Sep 15, 2023 •

edited

UNC3944 has also found use of some of the more niche features and applications within Azure to move laterally and conduct data theft. On multiple occasions UNC3944 has moved laterally within an organization's Azure environment using the Special Administration Console to connect to virtual machines via serial console.

https://www.mandiant.com/resources/blog/unc3944-sms-phishing-sim-swapping-ransomware

christophetd added kind/new-technique platform/azure labels

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment