Azure VM with high severity vulnerabilities allows lateral movement to Critical Azure storage account with sensitive data

Question

Azure VM with high severity vulnerabilities allows lateral movement to Critical Azure storage account with sensitive data

Bogdan Eremia 20

Hi

I got a lot of emails about

"Azure VM with high severity vulnerabilities allows lateral movement to Critical Azure storage account with sensitive data" where there is no usefully information. I opened more that 2 months ago a support case and told me that is a bug. Is bug fix or I have an issue in entire azure?

Jose Benjamin Solis Nolasco 3,256 Reputation points

2025-05-30T12:45:16.1133333+00:00
Hi Bogdan Eremia,

Below is a list of steps

Isolate the VM - https://learn.microsoft.com/en-us/defender-endpoint/respond-machine-alerts

If you are using MDE consider Immediately isolating the compromised VM from the network to prevent further lateral movement.

Patch Vulnerabilities

Ensure that all high severity vulnerabilities on the VM are patched. This can be done by:

Enable Network Security Groups (NSGs) - https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview

Configure NSGs to restrict inbound and outbound traffic to the VM. Only allow necessary traffic and block all other traffic.

Implement Just-In-Time (JIT) VM Access - https://learn.microsoft.com/en-us/azure/defender-for-cloud/just-in-time-access-overview?tabs=defender-for-container-arch-aks

Use Azure Security Center to enable JIT VM access, which reduces exposure to attacks by allowing you to control the time window during which the VM can be accessed.

Use Azure Defender

Enable Azure Defender for your VMs and storage accounts to provide advanced threat protection and security alerts.

Review and Harden Storage Account Access

Ensure that the storage account is not publicly accessible.

Use Azure RBAC to grant the least privilege necessary.

Enable Azure Storage firewalls and virtual networks to restrict access to the storage account.

Monitor and Audit

Use Azure Monitor and Azure Sentinel to continuously monitor for suspicious activities.

Regularly review audit logs to detect any unauthorized access attempts.

Implement Multi-Factor Authentication (MFA)

😊 If my answer helped you resolve your issue, please consider marking it as the correct answer. This helps others in the community find solutions more easily. Thanks!
Goutam Pratti 6,170 Reputation points Microsoft External Staff Moderator

2025-05-30T17:22:09.0633333+00:00

Hello @Bogdan Eremia ,

Can you please provide me the case ID number in the private message.
Jose Benjamin Solis Nolasco 3,256 Reputation points

2025-06-01T00:42:57.0133333+00:00

Just following up, Do you need more guidance or assistance ?

1 answer

Your answer

Jose Benjamin Solis Nolasco 3,256 Reputation points

2025-05-30T12:45:16.1133333+00:00

Hi Bogdan Eremia,

Below is a list of steps

Isolate the VM - https://learn.microsoft.com/en-us/defender-endpoint/respond-machine-alerts

If you are using MDE consider Immediately isolating the compromised VM from the network to prevent further lateral movement.

Patch Vulnerabilities

Ensure that all high severity vulnerabilities on the VM are patched. This can be done by:

Enable Network Security Groups (NSGs) - https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview

Configure NSGs to restrict inbound and outbound traffic to the VM. Only allow necessary traffic and block all other traffic.

Implement Just-In-Time (JIT) VM Access - https://learn.microsoft.com/en-us/azure/defender-for-cloud/just-in-time-access-overview?tabs=defender-for-container-arch-aks

Use Azure Security Center to enable JIT VM access, which reduces exposure to attacks by allowing you to control the time window during which the VM can be accessed.

Use Azure Defender

Enable Azure Defender for your VMs and storage accounts to provide advanced threat protection and security alerts.

Review and Harden Storage Account Access

Ensure that the storage account is not publicly accessible.

Use Azure RBAC to grant the least privilege necessary.

Enable Azure Storage firewalls and virtual networks to restrict access to the storage account.

Monitor and Audit

Use Azure Monitor and Azure Sentinel to continuously monitor for suspicious activities.

Regularly review audit logs to detect any unauthorized access attempts.

Implement Multi-Factor Authentication (MFA)

😊 If my answer helped you resolve your issue, please consider marking it as the correct answer. This helps others in the community find solutions more easily. Thanks!
Goutam Pratti 6,170 Reputation points Microsoft External Staff Moderator

2025-05-30T17:22:09.0633333+00:00

Hello @Bogdan Eremia ,

Can you please provide me the case ID number in the private message.
Jose Benjamin Solis Nolasco 3,256 Reputation points

2025-06-01T00:42:57.0133333+00:00

Just following up, Do you need more guidance or assistance ?

Answer 1

Bogdan Eremia 20

@Goutam Pratti I was able to get in touch with user that help me last time. Thank you.

We can close the ticket.

Share via

Azure VM with high severity vulnerabilities allows lateral movement to Critical Azure storage account with sensitive data

1 answer

Your answer