- Enumerating with Reader permissions
	- Simply log in to the Azure portal and view all resources/export to CSV
	- PowerZure
		- Importing the Module will display current role, permissions, and available subscriptions
		- OPSEC NOTE: There are detections in Azure Security Center for this as well as MicroBurst
		- `Get-AzureTargets`
			- Compares the user role to the Azure scope to enumerate attack surface area
	- MicroBurst
		- `Get-AzDomainInfo -Verbose -Folder microburst-output`
			- Generates an entire directory dump full of all available info on all of the Azure subscriptions to which the user has access
			- If environment is very large, disable some of the information using the boolean options
	- Review Azure instance metadata (from the instance itself)
		- `curl -H Metadata:true --noproxy "*" "http://169.254.169.254/metadata/instance?api-version=2020-09-01" | jq`
		- Check for a managed identity
			- `curl -H Metadata:true -s 'http://169.254.169.254/metadata/identity/oauth2/ token?api-version=2018-02-01&resource=https%3A%2F%2Fmanag ement.azure.com%2F' | jq`
			- Resulting token can be used to interact with the Azure REST APIs. Can also be used with MicroBurst to gather key vault secrets and storage account keys
	- Credential Harvesting
		- Check previous deployments for resource groups 
			- Look for misconfigured parameter types - passwords set as "String" instead of "SecureString"
			- Check deployment output sections - can include sensitive values and even "SecureString" values in cleartext
			- `Get-AzDomainInfo` in MicroBurst gathers all this deployment info; check Development\\Resources\\Deployments.txt for creds
		- Managed Identities - can have elevated permissions in environment
			- `appid=$(az resource list --query "[?name=='\<resource name\>'].identity.principalId" --output tsv)`
				- Retrieve resource information and cast to the "appid" variable
			- `az role assignment list --assignee $appid --include-groups --include-inherited --query'[].{username:principalName, role:roleDefinitionName, usertype:principalType, scope:scope}'`
				- List role assigments, specifying role name, principal name, type, and scope
			- Can also be done with the REST API