Azure azure_policy

This control may provide recommendations to enable scanning and auditing of container images. This can provide information on images that have been added with high privileges or vulnerabilities.

This control can protect against abuse of remote services.

This control may provide recommendations to restrict public access to Remote Desktop Protocol.

This control may provide recommendations to restrict public SSH access and enable usage of SSH keys.

This control may provide recommendations for vulnerability assessment and outdated applications and cloud services. This control covers a wide range of Azure cloud services to help reduce the surface area for exploitation.

This control can protect against command and control via application layer protocol.

This control may provide recommendations to enable Azure Defender for DNS which can monitor DNS queries between Azure applications for malicious traffic.

This control can protect against abuse of valid accounts.

This control may provide recommendations to audit and restrict privileges on Azure cloud accounts. This control may provide information to reduce surface area for privileged access to Azure.

This control can protect against account manipulation.

This control may recommend removing deprecated accounts, reducing privileges, and enabling multi-factor authentication. This can reduce the amount of accounts available to be exploited and what could be done with those accounts.

This control may provide recommendations for vulnerability assessment and outdated applications and cloud services. This control covers a wide range of Azure cloud services to help reduce the surface area for exploitation.

This control may provide recommendations to enable Azure security controls to harden remote services and reduce surface area for possible exploitation.

This control may provide recommendations for vulnerability assessment and outdated applications and cloud services. This control covers a wide range of Azure cloud services to help reduce the surface area for exploitation.

This control may provide recommendations for vulnerability assessment and outdated applications and cloud services. This control covers a wide range of Azure cloud services to help reduce the surface area for exploitation.

This control may provide recommendations to enable soft deletion and purge protection in Azure Key Vault. This can help mitigate against malicious deletion of keys and secrets stored within Key Vault.

This control may provide recommendations that protect from lifecycle-triggered deletion.

This control can protect against abuse of server software components for persistence.

This control may provide recommendations to enable other Azure controls that provide information on potentially exploitable SQL stored procedures. Recommendations to reduce unnecessary privileges from accounts and stored procedures can mitigate exploitable of this technique.

This control may provide recommendations to enable security controls that monitor and prevent malicious transfer of data to cloud accounts.

This control can protect against abuse of remote cloud services.

This control can protect against abuse of direct cloud VM connections.

This control may provide recommendations to enable various Azure services that route traffic through secure networks, segment all network traffic, and enable TLS encryption where available.

This control can protect against brute force attacks.

This control may provide recommendations to implement multi-factor authentication, implement password security policies, and replacing password authentication with more secure authentication methods. This control can affect Azure, Azure cloud application, and endpoint credentials.

This control may provide recommendations to implement multi-factor authentication, implement password security policies, and replacing password authentication with more secure authentication methods. This control can affect Azure, Azure cloud application, and endpoint credentials.

This control may provide recommendations to implement multi-factor authentication, implement password security policies, and replacing password authentication with more secure authentication methods. This control can affect Azure, Azure cloud application, and endpoint credentials.

This control may provide recommendations to secure external remote services, such as restricting SSH access, enabling multi-factor authentication for VPN access, and auditing external remote services that are not necessary or updated.

This control may provide recommendations to restrict access to applications that are public facing and providing information on vulnerable applications.

This control may provide recommendations to enable Azure services that limit access to cloud services. Several Azure services and controls provide mitigations against cloud service discovery.

This control may provide recommendations to enable Azure Defender for Storage and other security controls to prevent access to data from cloud storage objects.

This control may provide recommendations to restrict the allowed locations your organization can specify when deploying resources or creating resource groups.

This control may provide recommendations to enable Azure services that limit access to Azure Resource Manager and other Azure dashboards. Several Azure services and controls provide mitigations against this technique.

This control may provide recommendations for auditing and hardening Azure Key Vault to prevent malicious access and segment key access.

This control may provide recommendations for auditing and hardening Azure Key Vault to prevent malicious access and segment key access.

This control may provide recommendations to enable Azure services that limit access to cloud infrastructure. Several Azure services and controls provide mitigations against cloud infrastructure discovery.

This control may provide recommendations to restrict access to cloud resources from public networks and to route traffic between resources through Azure. Recommendations are also provided to use private DNS zones. If these recommendations are implemented the visible network information should be reduced.

This control can protect against gathering victim networking information.

This control can protect against gathering victim networking information.

This control can protect against gathering victim networking information.

This control can protect against gathering victim networking information.