> For the complete documentation index, see [llms.txt](https://wongkenny240.gitbook.io/computerforensics/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://wongkenny240.gitbook.io/computerforensics/cloud/azure-forensic.md).

# Azure Forensic

## Azure Security Centre

Azure Security Centre triggers alerts from signatures and heuristics:

![](https://3899724814-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LbSIGOSblVtuEjzcmhL%2F-MQRg80oE8tthS7JXvuH%2F-MQRgS7thTE7ILn68NGQ%2Fimage.png?alt=media\&token=9f4e9792-a9da-42e7-ae3a-1f3e80e038d3)

![](https://3899724814-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LbSIGOSblVtuEjzcmhL%2F-MQRg80oE8tthS7JXvuH%2F-MQRgYeBF-2gqSw8PGHK%2Fimage.png?alt=media\&token=142feaf6-98c6-4547-988e-61856de2d7d4)

And Azure also integrates with a number of third party solutions to provide detection capabilities, such as BitDefender:

![](https://3899724814-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LbSIGOSblVtuEjzcmhL%2F-MQRg80oE8tthS7JXvuH%2F-MQRgcBvReKs323Saama%2Fimage.png?alt=media\&token=753c4572-a014-4422-a473-3245daf5c044)

Microsoft may also send you an alert if they notice clear evidence of a compromise coming from your account:

![](https://3899724814-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LbSIGOSblVtuEjzcmhL%2F-MQRg80oE8tthS7JXvuH%2F-MQRggtPtxVboBRHFGeH%2Fimage.png?alt=media\&token=b12d92a5-9661-4c4f-a555-ca7371b0d4e0)

Azure Security Centre includes built-in tools to search through logs, and record investigative findings:

![](https://3899724814-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LbSIGOSblVtuEjzcmhL%2F-MQRg80oE8tthS7JXvuH%2F-MQRgpsYt5qPbGZjdS1_%2Fimage.png?alt=media\&token=d1d482a6-1f5e-4d91-9462-7dc99830aecf)

Source: <https://medium.com/@cloudyforensics/azure-forensics-and-incident-response-c13098a14d8d>

## Azure Acquisition

It is possible to acquire a snapshot of a machine within Azure in a number of ways, normally in VHD format.

### Magnet AXIOM

1. Go to 'Evidence sources' and select 'Cloud'
2. Select Azure and fill out the details including: Application ID, Tenant ID, Subscription ID, Client secret

   How to article to obtain the details: <https://support.magnetforensics.com/s/article/Find-Azure-authentication-details>
3. Select the VM and click Next
4. Hit ‘Go,’ ‘Analyze evidence,’

   ![](https://3899724814-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LbSIGOSblVtuEjzcmhL%2F-MQRbSMZno91aaddPSQQ%2F-MQRbVcKCC5YxTRdp6BY%2Fimage.png?alt=media\&token=6914e26c-be04-44f5-a139-e32c21faf94f)

![](https://3899724814-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LbSIGOSblVtuEjzcmhL%2F-MQRdsDfjEEEs9itCAXf%2F-MQRe3mbtJ0cTkVLBgaA%2Fimage.png?alt=media\&token=5174d3ae-1ad5-4950-9854-c71d76ed49cd)

### libcloudforensic

### Create a snapshot of VM using the portal or Powershell

#### Use the Azure portal

To create a snapshot, complete the following steps:

1. On the Azure portal, select **Create a resource**.
2. Search for and select **Snapshot**.
3. In the Snapshot window, select **Create**. The Create snapshot window appears.
4. Enter a Name for the snapshot.
5. Select an existing Resource group or enter the name of a new one.
6. Select an Azure datacenter Location.
7. For **Source disk**, select the managed disk to snapshot.
8. Select the Account type to use to store the snapshot. Select Standard\_HDD, unless you need the snapshot to be stored on a high-performing disk.
9. Select **Create**.

#### Use Powershell

* Set some parameters:

```
$resourceGroupName = 'myResourceGroup' 
$location = 'eastus' 
$vmName = 'myVM'
$snapshotName = 'mySnapshot'
```

* Get the VM:

```
$vm = Get-AzVM `
    -ResourceGroupName $resourceGroupName `
    -Name $vmName
```

* Create the snapshot configuration. For this example, the snapshot is of the OS disk:

```
$snapshot =  New-AzSnapshotConfig `
    -SourceUri $vm.StorageProfile.OsDisk.ManagedDisk.Id `
    -Location $location `
    -CreateOption copy
```

* Take the snapshot:

  ```
  New-AzSnapshot `
   -Snapshot $snapshot `
   -SnapshotName $snapshotName `
   -ResourceGroupName $resourceGroupName
  ```

### Spin up a new VM for investigation

1. Select **Create a Resource** and search for ‘**Managed Disks**’.&#x20;
2. When creating your Managed Disk, fill out the standard information. However, under ‘Source type’ make sure this is set to ‘**Snapshot**’ and then select your Snapshot that you have created.
3. From the Managed Disk screen you should see an option to ‘**Create VM**’, click this option.
4. Fill out the required information on the Create VM page

![Create snapshot](https://3899724814-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LbSIGOSblVtuEjzcmhL%2F-MQRdsDfjEEEs9itCAXf%2F-MQReObSOXhoqcc0DW7f%2Fimage.png?alt=media\&token=be64595c-980b-4bb9-aec9-f201a4d05b56)

![name your snapshot and allocate it to a resource group](https://3899724814-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LbSIGOSblVtuEjzcmhL%2F-MQRdsDfjEEEs9itCAXf%2F-MQReWUb9fMVQfPVi8Jf%2Fimage.png?alt=media\&token=7ce825a0-df81-40a5-a58c-181b143801b4)

![Create a resource > Create Managed Disk](https://3899724814-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LbSIGOSblVtuEjzcmhL%2F-MQReclXmn57L5KMYtiu%2F-MQRf03yA4XsXJvSgPbC%2Fimage.png?alt=media\&token=58274b5b-9e3a-4bc9-9d5b-d6aa8cad0e46)

![Source type select Snapshot](https://3899724814-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LbSIGOSblVtuEjzcmhL%2F-MQReclXmn57L5KMYtiu%2F-MQRf9tqBCcYzsZPYala%2Fimage.png?alt=media\&token=855ec6db-0f80-4a57-aafc-575772047039)