aa persistence

src/pentesting-cloud/azure-security/az-persistence/az-automation-accounts-persistence.md

@@ -0,0 +1,38 @@
+# Az - Automation Accounts Persistence
+
+{{#include ../../../banners/hacktricks-training.md}}
+
+## Storage Privesc
+
+For more information about Automation Accounts check:
+
+{{#ref}}
+../az-services/az-automation-account.md
+{{#endref}}
+
+
+### Backdoor existing runbook
+
+If an attacker has access to the automation account, he could **add a backdoor** to an existing runbook to **maintain persistence** and **exfiltrate data** like tokens every time the runbook is executed.
+
+### Schedules & Webhooks
+
+Create or modify an existing Runbook and add a schedule or webhook to it. This will allow an attacker to **maintain persistence even if access over the environment was lost** by executing the backdoor which might be leaking tokens from the MI at specific times or whenever he wants by sending a request to the webhok.
+
+### Malware inside a VM used in a hybrid worker group
+
+If a VM is used as a hybrid worker group, an attacker could **install malware** inside the VM to **maintain persistence** and **exfiltrate data** like tokens for the managed identities given to the VM and to the automation account using the VM.
+
+### Custom environment packages
+
+If the automation account is using custom packages in custom environments, an attacker could **modify the package** to **maintain persistence** and **exfiltrate data** like tokens. This would also be a stealth persistence method as custom packages uploaded manually are rearely checked for malicious code.
+
+### Compromise external repos
+
+If the automation account is using external repos to store the code like Github, an attacker could **compromise the repo** to **maintain persistence** and **exfiltrate data** like tokens. This is specially interesting if the clatest evrsion of the code is automatically synced with the runbook.
+
+
+{{#include ../../../banners/hacktricks-training.md}}
+
+
+

src/pentesting-cloud/azure-security/az-services/az-automation-accounts.md

@@ -234,6 +234,12 @@ Get-AzAutomationHybridWorkerGroup -AutomationAccountName <AUTOMATION-ACCOUNT> -R
 ../az-privilege-escalation/az-automation-accounts-privesc.md
 {{#endref}}
 
+## Persistence
+
+{{#ref}}
+../az-persistence/az-automation-accounts-persistence.md
+{{#endref}}
+
 ## References
 
 - [https://learn.microsoft.com/en-us/azure/automation/overview](https://learn.microsoft.com/en-us/azure/automation/overview)