Incident Response in the Cloud

During this 5-day course of super intensive training you will gain crucial cybersecurity knowledge and skills in terms of Incident Response in the Cloud.

You´ll be able to:

  • Get the highest quality and unique learning experience – the class is limited to 16 participants by default.
  • Get the opportunity to interact with our world-renowned Experts.
  • Go through CQURE’s custom lab exercises and practice them after the course.
  • Receive a lifelong certification after completing the course!

Why this course?

This immersive five-day training delivers a complete, hands-on journey through Azure security, identity abuse, threat detection, and cloud incident response. Students begin by establishing core foundations – Azure architecture, governance, logging, and the security stack, before progressing into the full Azure Cyber Kill Chain. Participants will perform real-world attacks across identity, compute, storage, and control-plane layers, including token theft, AiTM phishing, privilege escalation, service principal compromise, misconfigurations, and persistence techniques unique to Azure.

Prerequisites

To attend this training, you should have a good hands-on experience in administering Windows infrastructure. At least 5 years in the field is recommended. All attendees should have experience with Active Directory Domain Services (AD DS) administration.

 Target Audience

 

The course is perfect for security architects, Entra ID administrators, security administrators, and security auditors.


Module 1: Azure Security & IR Fundamentals

  1. a) Shared responsibility model & Azure security layers
  2. b) Azure Terminology & Hierarchy (Tenants, Subs, MGMT Groups)
  3. c) Azure Resource Manager (ARM) & control-plane concepts
  4. d) Azure Compute, Network, and Storage components
  5. e) Azure Security components (Defender for Cloud, Sentinel)
  6. Threat modeling for Azure services

Module 2: Deep Dive into Entra ID & Governance

  1. a) Entra ID Overview: Users, Groups, Service Principals, Managed Identities
  2. b) Entra ID Roles (Azure AD vs. Azure RBAC)
  3. c) Entra ID – Tokens (Access, Refresh, PRT, SSO) & Auth Flows
  4. d) Privileged Identity Management (PIM) basics
  5. Entra ID – Hybrid Setup (Connect, Sync, ADFS)

Module 3: Core Controls, Benchmarks & Logging

  1. a) Azure Security Benchmark (ASB) & Secure Score
  2. b) Network Security Groups, Firewall, basic segmentation
  3. c) Azure Audit & Logging: Activity Logs, Resource Logs, Entra ID Logs
  4. Defender for Cloud & Sentinel logging architecture

Module 4: Reconnaissance & Initial Access

  1. a) Azure Attack Overview
  2. b) Reconnaissance: Internal and External
  3. c) Initial Access: Valid accounts, Password Attacks (Spray, Stuffing)
  4. d) Initial Access: Malicious apps & illicit consent grants
  5. e) Initial Access: Phishing (Traditional, AiTM) & MiTM attacks
  6. Demo: AiTM in action

Module 5: Infrastructure & Network Attacks

  1. a) Attacking Azure VMs, extensions, managed identities
  2. b) Exploiting VM agent weaknesses
  3. c) Attacking storage accounts & SAS tokens
  4. d) Attack flow with public endpoints & Bypassing NSGs
  5. Demo: enumerating cloud resources through token leakage

Module 6: Execution & Privilege Escalation

  1. a) Execution: Azure RunCommand, Serial Console, Automation accounts
  2. b) Execution: Function app, Intune & Cloud Shell
  3. c) Privilege Escalation: PIM & Elevated Access Toggle
  4. d) Privilege Escalation: Abusing ARM APIs
  5. e) Privilege Escalation: Misconfigured Azure AD applications
  6. Demo: privilege escalation via misconfigured app registrations

Module 7: Advanced Identity Attacks & Credential Access

  1. a) Conditional Access design and common failures
  2. b) Token replay & token theft
  3. c) Pass-the-PRT, stealing session artifacts
  4. d) Attacking service principals & managed identities
  5. Credential Access: Application secrets & KeyVault dumping

Module 8: Persistence Technique

  1. a) Account Creation (Guest, Shadow Admin)
  2. b) Network Security Group Modification
  3. c) Azure Lighthouse & Delegated Administrators
  4. d) Cross-Tenant Synchronization & Subscription Transfers
  5. e) Federated options (Golden SAML)
  6. f) Persistence in Azure (Apps, Functions, SPNs, connectors)
  7. Demo: persistent backdoor through Azure App Registration

Module 9: Exfiltration & Impact

  1. a) Exfiltration: Storage accounts, SAS tokens, data services
  2. b) Impact: Resource Deletion & Cryptomining
  3. Cross-tenant attacks & multi-cloud attack paths

Module 10: KQL for Incident Response

  1. a) KQL Introduction & Syntax
  2. b) Need-to-know KQL commands (let, join, parse, extend)
  3. c) KQL for Incident Response & Resources
  4. d) Sentinel log ingestion best practices
  5. Demo: Building a KQL hunting query from scratch

Module 11: Advanced Hunting & Detection

  1. a) Advanced KQL (UDFs, functions, make-series)
  2. b) Using KQL to hunt for identity attacks (token theft, persistence)
  3. c) Hunting for resource manipulation via ARM
  4. d) Hunting for compromised service principals
  5. Demo: building a custom analytic rule in Sentinel

Module 12: Graph API for Incident Response

  1. a) Introduction & Graph Explorer
  2. b) Graph Application setup with a certificate
  3. c) Graph API calls for IR (enumerating users, apps, logs)
  4. d) Investigating Microsoft Graph Activity Logs
  5. Azure Attack tools overview

Module 13: Responding to Azure Attacks (NIST)

  1. a) Introduction & NIST model
  2. b) Cloud-first vs hybrid IR scenarios
  3. c) Cloud Incident Response: Preparation
  4. d) Cloud Incident Response: Investigate & Contain
  5. e) Evidence acquisition in Azure & live response
  6. f) Azure Incident Response tools
  7. Demo: investigating an Azure compromise end-to-end

Module 14: Remediation & Strategic Hardening

  1. a) Cloud Incident Response: Remediate & Recover
  2. b) Token & Session Revocation (Entra ID, Azure)
  3. c) Responding to identity compromise vs. resource compromise
  4. d) Zero Trust in Azure & Secure Landing Zones
  5. Advanced key management (Key Vault, HSM)

Module 15: Advanced & Strategic Best Practices

  1. a) Supply chain attacks via Azure DevOps
  2. b) Designing a secure cloud operating model
  3. c) Continuous compliance, automation, & IaC security
  4. d) DevSecOps in Azure
  5. Governance & policy enforcement at scale

Certification

After finishing the course, you will be granted a CQURE Certificate of Completion. Please note that after completing the course you will also be eligible for CPE points!

 


FAQ – Introduction to Penetration Testing

Varighet: 5 dager (35 timer)
Format: Klasserom eller live online med virtuelle laber
Sertifisering: Livslang CQURE Certificate of Completion

Hva lærer jeg på dette kurset?

Du får en komplett og praktisk gjennomgang av hvordan angrep i Azure gjennomføres – og hvordan de oppdages, analyseres og håndteres profesjonelt.

Kurset dekker hele livssyklusen:

  • Azure-arkitektur og sikkerhetsfundament
  • Identitetsangrep i Entra ID
  • Token-tyveri og AiTM phishing
  • Privilege escalation i Azure
  • Persistence-teknikker i cloud
  • Dataeksfiltrasjon og impact-scenarier
  • KQL og Sentinel for avansert hunting
  • Incident Response etter NIST-modellen
  • Strategisk hardening og Zero Trust

Hvem passer kurset for?

Kurset er spesielt relevant for:

  • Security architects
  • Entra ID administrators
  • Security administrators
  • Security auditors
  • Cloud security engineers
  • Incident responders

Hvilke forkunnskaper kreves?

Du bør ha solid praktisk erfaring med Windows-infrastruktur. Minimum 5 års erfaring anbefales. Du må også ha erfaring med Active Directory Domain Services (AD DS).

Dette er et avansert kurs og ikke egnet for nybegynnere.

Hvordan foregår kurset?

Kurset går over fem intensive dager med:

  • Live undervisning fra erfarne CQURE-eksperter
  • Hands-on laber i realistiske Azure-miljøer
  • Praktiske angrep og defensive scenarier
  • Direkte interaksjon med instruktører
  • Små klasser (maks 16 deltakere)

Er kurset praktisk?

Ja, dette er et sterkt hands-on kurs. Du gjennomfører faktiske angrepsscenarier i Azure, analyserer logger, bygger hunting queries og håndterer et komplett cloud-kompromiss fra start til slutt.

Hva slags angrep lærer jeg om?

Du jobber med blant annet:

  • Password spray og credential stuffing
  • Malicious app consent
  • AiTM phishing
  • Token replay og Pass-the-PRT
  • Service principal-angrep
  • ARM API-misbruk
  • Misconfigurations i Azure
  • Storage- og SAS-token-angrep
  • Golden SAML
  • Persistence via App Registrations
  • Cryptomining og ressursødeleggelse

Lærer jeg detection og hunting?

Ja. En stor del av kurset handler om detection og incident response.

Du lærer:

  • KQL fra grunnleggende til avansert nivå
  • Hvordan bygge egne hunting queries
  • Hvordan lage analytiske regler i Sentinel
  • Hvordan bruke Graph API i Incident Response
  • Hvordan samle og analysere bevis i Azure

Får jeg sertifisering?

Ja. Etter fullført kurs mottar du en livslang Certificate of Completion. Sertifiseringen krever ingen fornyelse.

Hva skiller dette kurset fra andre Azure-sikkerhetskurs?

Dette er ikke bare et konfigurasjonskurs – du lærer hvordan faktiske angripere opererer i Azure.

Kurset dekker hele Azure Cyber Kill Chain og kombinerer:

  • Offensive teknikker
  • Detection engineering
  • Incident response
  • Strategisk hardening
  • Alt basert på erfaring fra reelle prosjekter.

Hva vil jeg sitte igjen med etter kurset?

Du vil kunne:

  • Identifisere og analysere Azure-angrep
  • Håndtere token- og identitetskompromisser
  • Utføre cloud-first incident response
  • Bruke KQL effektivt i jakt på trusler
  • Designe bedre sikkerhetsarkitektur i Azure
  • Etablere Zero Trust og sikre landing zones

Hvorfor er dette viktig nå?

Cloud-angrep er identitetsbaserte, raske og ofte vanskelige å oppdage. Tradisjonell on-prem incident response er ikke tilstrekkelig.

Dette kurset gir deg ferdighetene som trengs for å håndtere moderne trusler i Azure-miljøer.

Hvis du ønsker kan jeg også lage en kort “Included items”-liste i samme stil som vi gjorde for forrige kurs.

 

See other relevant courses to explore:

Other relevant courses

MasterClass: Hacking and Securing Windows Infrastructure
5 days
Virtual Classroom Guaranteed to run
Masterclass: Internet Information Services Management (IIS)
4 days
Virtual Classroom
Masterclass: System Forensics, Incident Handling And Threat Hunting
3 days
Virtual Classroom
MasterClass: Windows Security and Infrastructure Management with Windows Internals
23. March
4 days
Classroom Virtual