fwd:cloudsec - Leveraging Azure Resource Graph for Good and for Evil - Darwin Salazar

‍

In this fwd:cloudsec presentation, Darwin Salazar explores the dual nature of Azure Resource Graph (ARG) as both a defensive asset and a potential reconnaissance tool for adversaries. He demonstrates how ARG's extensive visibility across Azure subscriptions can be harnessed by blue teams for asset discovery and compliance auditing, while also highlighting how red teams might exploit its capabilities to bypass traditional logging mechanisms during the discovery phase of an attack.

Through practical examples and live demonstrations, Darwin illustrates the power of Kusto Query Language (KQL) in querying ARG, emphasizing the importance of understanding and monitoring ARG usage to bolster security postures. This session is essential for security professionals aiming to grasp the nuances of ARG and its implications in both offensive and defensive contexts.

‍

Watch the full talk on YouTube!