C-AZ-MANAGED-ID-ESCPrivilege Escalation

Azure Managed Identity Escalation

Assign a higher-priv managed identity to a VM you control, then hit IMDS to assume it.

§ Where this technique fits

C-AZ-MANAGED-ID-ESC is catalogued under the Privilege Escalation tactic of the offensive-security kill-chain. It appears in 1 approved dossier in the registry, typically at step 2 on average.

§ Dossiers chaining this technique

Compromised VM → Managed Identity → Subscription Owner
A VM with an over-privileged system-assigned managed identity is compromised; query IMDS for an Azure AD token, then assign yourself Owner on the subscription.
step 2 / 5

§ What commonly comes next

01
Account Discovery
T1087 · Discovery
seen 1×

§ Where this technique fits

§ Dossiers chaining this technique

Compromised VM → Managed Identity → Subscription Owner

§ What commonly comes next