Lab scenario¶

The engagement¶

Cocoaman LLC has hired your security assessment team to evaluate an Azure tenant. The company has grown quickly, and its environment now contains a mix of Entra ID identities, Azure resources, role assignments, managed identities, application credentials, and data-plane services.

Previous reviews examined these components individually and did not identify a single obviously critical permission. Cocoaman's security team is concerned that several ordinary permissions and trust relationships may chain together into an attack path that is difficult to recognize from an identity-only view.

You have been given an authorized, low-privilege identity in the lab tenant. Your task is to determine how far an attacker starting with that identity could progress.

Your mission¶

Assess the tenant from the perspective of the assigned identity and find a path that allows you to:

1. enumerate accessible identities, permissions, and Azure resources;
2. identify relationships that connect the starting identity to other principals or workloads;
3. perform lateral movement through the documented lab environment; and
4. escalate privileges to the designated high-value target.

You will use Cirro to collect the environment, map the available evidence into Neo4j, and analyze the resulting graph.

Assessment objective¶

The objective is not merely to obtain a privileged role. A successful assessment explains the complete path:

• where the initial access begins;
• which identity, RBAC, ARM, and data-plane relationships make each step possible;
• how lateral movement creates access to a new security principal or workload;
• where privilege escalation occurs; and
• how Cocoaman LLC can break the path.

Success criteria¶

By the end of the lab, you should be able to:

• analyze a management-plane attack path across identities, Azure RBAC, and ARM resources;
• extend the analysis into a data-plane attack path involving access within an Azure service;
• connect both paths into a single, evidence-backed privilege-escalation chain;
• demonstrate the intended lateral-movement steps; and
• achieve Global Reader permissions in the authorized lab tenant.

Rules of engagement¶

• Use only the accounts, resources, and techniques identified by the lab.
• Do not establish persistence or make destructive changes.
• Do not access unrelated tenants, subscriptions, or personal environments.
• Treat collected databases, tokens, credentials, and secret values as sensitive assessment material.
• If a result differs from the documented scenario, pause and ask an instructor before continuing.