Rogue Azure Lab

Reconstruct a multi-stage Azure attack timeline by analyzing Entra ID, Audit, and Storage Blob logs using Kusto Query Language to identify initial access, persistence, privilege escalation, and data exfiltration.

Category:

Cloud Forensics

Tactics:

Initial Access Persistence Privilege Escalation Stealth Credential Access Discovery Lateral Movement Collection Exfiltration

Tools:

Azure AD Sign-in Logs Microsoft Sentinel Azure Monitor KQL Query Editor

easy

1hr

Sign in to Download Lab Files

Unlock Your Full Learning Experience with CyberRange Labs

Sign up to track your progress, unlock exclusive labs, and showcase your achievements—begin your journey now!