Defender for Cloud Attack Path Analysis

Attack Path Analysis is a graph-based security feature in Microsoft Defender for Cloud (formerly Azure Security Center) that identifies the most likely routes an attacker could take to compromise your cloud environment. It does not simply list vulnerabilities; it correlates multiple security findings—such as open management ports, high-privileged identities, exposed storage accounts, and missing encryption—into a directed graph that shows the chain of exploitable conditions. The result is a prioritized list of attack paths, each with a risk score, that helps security teams focus on the highest-impact remediations.

Traditional vulnerability management tools present security issues in isolation: a VM has an open SSH port, a storage account is publicly accessible, a SQL database has a weak firewall rule. But attackers rarely exploit a single weakness; they chain multiple weaknesses to achieve their objective. For example, an attacker might:

Attack Path Analysis automates the discovery of such chains, showing you the full picture. Without it, you might prioritize fixing the open SSH port, but the real danger is the chain that leads to data exfiltration. With attack paths, you see that the critical fix is to restrict the VM's managed identity permissions, which breaks the chain at the privilege escalation step.

Defender for Cloud continuously collects security data from your Azure resources via the Log Analytics agent, Azure Policy, and built-in vulnerability scanners. This data includes:

The analysis engine then builds a graph model of your environment. Nodes represent resources (VMs, storage accounts, key vaults, SQL servers, etc.) and edges represent possible attacker actions (e.g., "can connect from VM to storage account via managed identity"). The engine uses a set of predefined attack vectors and a knowledge base of common exploitation techniques to simulate how an attacker could move from an initial entry point (e.g., an internet-facing VM with a vulnerability) to a target (e.g., a storage account with sensitive data).

The simulation is not a live attack—it's a static analysis of configurations and vulnerabilities. It does not trigger any actual changes. The engine runs periodically (typically every 12 hours) and on-demand when you request a refresh. Results are stored in the Defender for Cloud database and displayed in the Azure portal.

Each attack path consists of: - Start node: The initial resource an attacker can access (e.g., a VM with a public IP and an open management port). - End node: The target resource with high business impact (e.g., a storage account with sensitive data, a key vault, a SQL database). - Path edges: Each step in the chain, represented as a directed arrow with a description of the action (e.g., "Use managed identity to access storage account"). - Risk score: A numerical value (0-100) that combines the severity of the vulnerabilities and the likelihood of exploitation. Higher scores indicate more critical paths. - Affected resources: All resources along the path. - Active alerts: Any security alerts associated with the path.

Defender for Cloud defines several path types based on common attack patterns. The exam focuses on these:

The risk score for an attack path is calculated using: - Severity of vulnerabilities (Critical, High, Medium, Low) - Exploitability (whether a known exploit exists, ease of exploitation) - Impact (what the attacker can achieve at the end node) - Number of steps (shorter paths are generally more dangerous) - Active threats (if there are ongoing attacks detected)

The formula is proprietary, but you should know that paths with a score above 70 are considered critical and should be addressed immediately.

Attack Path Analysis is automatically enabled when you enable Defender for Cloud's enhanced security features (Defender for Cloud's 'Defender for Cloud' plan, formerly Azure Defender). You do not need to install any agents or configure anything for the analysis itself—it works on existing data. However, to get the most value, you should:

You can view attack paths in the Azure portal under Defender for Cloud -> Attack Path Analysis. The interface shows a list of paths sorted by risk score, with a visual graph for each path. You can click on any path to see details and recommended remediation steps.

To trigger an on-demand refresh, click the 'Refresh' button. This initiates a new analysis that may take several minutes to complete.

Attack Path Analysis integrates with: - Microsoft Defender for Cloud's regulatory compliance dashboard: Attack paths can affect compliance scores (e.g., if a path exposes sensitive data, it may violate GDPR or PCI DSS). - Microsoft Sentinel: You can export attack path data to Sentinel for correlation with other security events. - Azure Policy: Misconfigurations that contribute to attack paths are often flagged by Azure Policy (e.g., 'Storage accounts should restrict network access'). - Just-In-Time (JIT) VM access: If you enable JIT, it reduces the attack surface by closing management ports by default, which can eliminate many attack paths.

When you identify a critical attack path, you should: 1. Break the chain at the most impactful point: Usually, the best point is where the attacker gains privileged access (e.g., remove the managed identity's role assignment). 2. Harden the start node: Close unnecessary ports, apply Just-In-Time access, patch vulnerabilities. 3. Harden the end node: Enable firewall rules, use private endpoints, enable encryption. 4. Monitor for active threats: Check if any security alerts are firing along the path.

While you cannot directly create attack paths via CLI, you can retrieve information about resources that contribute to paths. For example, to list all VMs with public IPs and open ports:

Get-AzNetworkInterface | Where-Object {$_.NetworkSecurityGroup -ne $null} | ForEach-Object {
    $nsg = Get-AzNetworkSecurityGroup -ResourceGroupName $_.ResourceGroupName -Name $_.NetworkSecurityGroup.Id.Split('/')[-1]
    $nsg.SecurityRules | Where-Object {$_.Direction -eq 'Inbound' -and $_.Access -eq 'Allow' -and $_.SourceAddressPrefix -eq '*'}
}

To check for managed identities with high privileges:

az role assignment list --assignee <vm-principal-id> --include-inherited --output table

But for the exam, focus on understanding the concept and the portal interface.

A large financial services company uses Azure to host a payment processing application. The application consists of VMs running a web server, a SQL database, and a storage account for transaction logs. The security team is required to maintain PCI DSS compliance. They enable Defender for Cloud and regularly review attack paths. One day, they find a critical attack path: an internet-facing VM (web server) has a critical vulnerability (CVE-2023-1234) and its managed identity has 'Storage Blob Data Contributor' role on the storage account containing transaction logs. The path score is 85. The team quickly patches the VM (breaking the initial access) and also removes the managed identity's write permission to the storage account (breaking the privilege escalation). They also enable Just-In-Time access to close the management port. This remediation reduces the risk score to 0 for that path. Without Attack Path Analysis, they might have only patched the VM, missing the fact that the managed identity could be used to exfiltrate logs. The team now has a monthly review of attack paths as part of their compliance process.

A healthcare provider runs an electronic health records (EHR) system on Azure Kubernetes Service (AKS). They store patient data in an Azure SQL database and encryption keys in an Azure Key Vault. They enable Defender for Cloud and find an attack path: a container in AKS has a vulnerability that allows privilege escalation, and the AKS cluster's managed identity has 'Key Vault Secrets User' role on the key vault. The path score is 92. The security team realizes that if an attacker compromises the container, they can read encryption keys and then decrypt the SQL database. They immediately restrict the AKS managed identity permissions to only the specific secrets needed, and they also enable network restrictions on the key vault to block public access. They also update the container image to patch the vulnerability. This scenario highlights the importance of least privilege for managed identities, even for AKS clusters.

An e-commerce company uses Azure for its online store. They have multiple VMs behind a load balancer, a storage account for product images, and a Cosmos DB for user profiles. They notice a medium-risk attack path: a storage account is configured to allow access from 'All networks', and a VM has a managed identity with 'Reader' role on that storage account. The path score is 45. While not critical, the team decides to remediate by enabling the storage account firewall and restricting access to only the load balancer's IP range. They also remove the managed identity's read permission since the VM doesn't need to read product images directly (it uses a CDN). This proactive measure prevents a potential data breach. In production, performance considerations include the fact that attack path analysis runs every 12 hours, so changes to permissions may not be reflected immediately. The team uses the on-demand refresh after making changes to verify that the path is eliminated.