#Lateral Movement

Abusing Azure Arc for Lateral Movement

Azure Arc bridges Azure management to on-premises and multi-cloud servers. We walk through how a compromised Azure identity abuses Custom Script Extensions to run code as Local System and pivot into hybrid environments, plus the detections that catch it.