Threat Hunting in the Cloud

CHAPTER 4Microsoft Azure Cloud Threat Prevention Framework

What's in This Chapter

• Introduction to Microsoft Security
• Understanding the Shared Responsibility Model
• Microsoft Services for Cloud Security Posture Management and Logging/Monitoring
  • Enabling Azure Security Center
  • Enabling Azure Defender
  • Enabling Azure Sentinel
• Microsoft Secure and Protect Features
  • How to use Azure Web Application Firewall to protect a website against “Initial Access” TTP
  • How to use Microsoft Defender for Office 365 for protection against “Initial Access” TTP
  • How to use Microsoft Defender Endpoint for protection against “Initial Access” TTP
  • How to use Azure Conditional Access for protection against “Initial Access” TTP
• Microsoft Detect Features
  • Detecting privilege escalation
  • Detecting credential access
  • Detecting lateral movement
  • Detecting command and control
  • Detecting data exfiltration
• Microsoft Respond and Recover Features
  • Automating investigation and remediation with Microsoft Defender for Endpoint
  • Using Microsoft Threat Expert support for remediation and investigation
  • Automating Security Response with MCAS and Microsoft Flow
  • How to perform an automated response using Azure Security Center
  • Using Machine Learning and Artificial Intelligence in Threat Response
  • Overview of Fusion Detection
  • Overview of Azure Machine Learning

This chapter focuses on using Microsoft services for cloud threat protection in alignment with the MITRE ATT&CK framework and the NIST Cybersecurity framework. ...