{"id":16517,"date":"2023-07-18T14:08:47","date_gmt":"2023-07-18T14:08:47","guid":{"rendered":"https:\/\/cybercrime.rs\/?p=16517"},"modified":"2023-07-24T22:45:35","modified_gmt":"2023-07-24T22:45:35","slug":"cloud-forensics-investigations-in-azure","status":"publish","type":"post","link":"https:\/\/cybercrime.rs\/en\/2023\/07\/18\/cloud-forensics-investigations-in-azure\/","title":{"rendered":"Cloud Forensics investigations in Azure"},"content":{"rendered":"<div data-elementor-type=\"wp-post\" data-elementor-id=\"16517\" class=\"elementor elementor-16517\">\n\t\t\t\t\t\t\t\t\t<section class=\"has_ae_slider elementor-section elementor-top-section elementor-element elementor-element-3ee0a16f elementor-section-boxed elementor-section-height-default elementor-section-height-default ae-bg-gallery-type-default\" data-id=\"3ee0a16f\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"has_ae_slider elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-2c478260 ae-bg-gallery-type-default\" data-id=\"2c478260\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-2f24010 elementor-widget elementor-widget-spacer\" data-id=\"2f24010\" data-element_type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor - v3.7.8 - 02-10-2022 *\/\n.elementor-column .elementor-spacer-inner{height:var(--spacer-size)}.e-container{--container-widget-width:100%}.e-container>.elementor-widget-spacer{width:var(--container-widget-width,var(--spacer-size));-ms-flex-item-align:stretch;align-self:stretch;-ms-flex-negative:0;flex-shrink:0}.e-container>.elementor-widget-spacer>.elementor-widget-container,.e-container>.elementor-widget-spacer>.elementor-widget-container>.elementor-spacer{height:100%}.e-container>.elementor-widget-spacer>.elementor-widget-container>.elementor-spacer>.elementor-spacer-inner{height:var(--container-widget-height,var(--spacer-size))}<\/style>\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d7faa36 elementor-widget elementor-widget-author-box\" data-id=\"d7faa36\" data-element_type=\"widget\" data-widget_type=\"author-box.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<link rel=\"stylesheet\" href=\"https:\/\/cybercrime.rs\/wp-content\/plugins\/elementor-pro\/assets\/css\/widget-theme-elements.min.css\">\t\t<div class=\"elementor-author-box\">\n\t\t\t\n\t\t\t<div class=\"elementor-author-box__text\">\n\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/www.linkedin.com\/in\/uros-babic-87a8a2120\/\" target=\"_blank\">\n\t\t\t\t\t\t<h4 class=\"elementor-author-box__name\">\n\t\t\t\t\t\t\tUro\u0161 Babi\u0107\t\t\t\t\t\t<\/h4>\n\t\t\t\t\t<\/a>\n\t\t\t\t\n\t\t\t\t\t\t\t\t\t<div class=\"elementor-author-box__bio\">\n\t\t\t\t\t\t<p>Cybersecurity Manager, MCT<\/p>\n\t\t\t\t\t<\/div>\n\t\t\t\t\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-652a5ca elementor-widget elementor-widget-spacer\" data-id=\"652a5ca\" data-element_type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-19479be2 elementor-widget elementor-widget-text-editor\" data-id=\"19479be2\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor - v3.7.8 - 02-10-2022 *\/\n.elementor-widget-text-editor.elementor-drop-cap-view-stacked .elementor-drop-cap{background-color:#818a91;color:#fff}.elementor-widget-text-editor.elementor-drop-cap-view-framed .elementor-drop-cap{color:#818a91;border:3px solid;background-color:transparent}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap{margin-top:8px}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap-letter{width:1em;height:1em}.elementor-widget-text-editor .elementor-drop-cap{float:left;text-align:center;line-height:1;font-size:50px}.elementor-widget-text-editor .elementor-drop-cap-letter{display:inline-block}<\/style>\t\t\t\t<!-- wp:paragraph -->\n<p>Cloud forensics seeks to apply the principles and methods of digital forensics within the cloud environment to investigate any security incident. To obtain digital evidence in a cloud environment, investigators must know the data location and the access level exercised by a specific organization on that data.<\/p>\n<!-- \/wp:paragraph -->\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-680b2fc elementor-widget elementor-widget-text-editor\" data-id=\"680b2fc\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Cloud forensics has many uses:<\/p>\n<ul>\n<li>Investigation<\/li>\n<\/ul>\n<p>Cloud forensics helps in finding the source of different cloud-based crimes and solving organized cloud crimes, policy violations in a public environment, and suspicious activities in a cloud environment. In the investigation process, all sources, including manual and mechanical, are analyzed and the results are revealed. This helps the clients and service providers to secure their cloud services.<\/p>\n<p>\u00a0<\/p>\n<ul>\n<li>Troubleshooting<\/li>\n<\/ul>\n<p>Cloud forensic techniques assist users in troubleshooting by determining the data and hosts that are physically and virtually present in a cloud environment. They allow users to find and resolve any errors or security issues in the cloud. They help in understanding the trends of past security attacks to tackle any incident in the future.<\/p>\n<p>\u00a0<\/p>\n<ul>\n<li>Log monitoring<\/li>\n<\/ul>\n<p>Cloud forensic techniques include processes for generating, storing, analyzing, and correlating the massive volumes of log data created within a cloud environment. These data help the users and service providers to audit, analyze, and calculate various aspects of the cloud environment; they also help security officials in checking whether a cloud system complies with the regulatory standards.<\/p>\n<p>\u00a0<\/p>\n<ul>\n<li>Data and system recovery<\/li>\n<\/ul>\n<p>Cloud forensics involves recovery procedures that help forensic practitioners in recovering lost, accidentally deleted, corrupted, and inaccessible data. It also enables the data acquisition of cloud systems and the creation of a forensic copy of the data that can be used by the service providers as back up; forensic experts can use this copy as evidence in the court of law.<\/p>\n<p>\u00a0<\/p>\n<ul>\n<li>Due diligence\/regulatory compliance<\/li>\n<\/ul>\n<p>Cloud forensics also deals with the security aspects of an organization in securing critical data, maintaining necessary records for auditing purposes, and notifying the concerned team when any suspicious activity is reported; for instance, if private data have been misused or exposed. It also helps in finding the sections that miss a regulatory compliance and fixes.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-aceadd8 elementor-widget elementor-widget-spacer\" data-id=\"aceadd8\" data-element_type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-3469859 elementor-widget elementor-widget-heading\" data-id=\"3469859\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor - v3.7.8 - 02-10-2022 *\/\n.elementor-heading-title{padding:0;margin:0;line-height:1}.elementor-widget-heading .elementor-heading-title[class*=elementor-size-]>a{color:inherit;font-size:inherit;line-height:inherit}.elementor-widget-heading .elementor-heading-title.elementor-size-small{font-size:15px}.elementor-widget-heading .elementor-heading-title.elementor-size-medium{font-size:19px}.elementor-widget-heading .elementor-heading-title.elementor-size-large{font-size:29px}.elementor-widget-heading .elementor-heading-title.elementor-size-xl{font-size:39px}.elementor-widget-heading .elementor-heading-title.elementor-size-xxl{font-size:59px}<\/style><h2 class=\"elementor-heading-title elementor-size-default\">Cyber Kill Chain<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-7920b3a elementor-widget elementor-widget-spacer\" data-id=\"7920b3a\" data-element_type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-163c5ad elementor-widget elementor-widget-text-editor\" data-id=\"163c5ad\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Security Center\u2019s threat protection includes fusion kill-chain analysis, which automatically correlates alerts in your environment based on cyber kill-chain analysis, to help you better understand the full story of an attack campaign, where it started and what kind of impact it had on your resources. Security Center\u2019s supported kill chain intents are based on the MITRE ATT&amp;CK\u2122 framework.<\/p>\n<p>As illustrated below, the typical steps that trace the stages of a cyberattack<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-56b79e2 elementor-widget elementor-widget-image\" data-id=\"56b79e2\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor - v3.7.8 - 02-10-2022 *\/\n.elementor-widget-image{text-align:center}.elementor-widget-image a{display:inline-block}.elementor-widget-image a img[src$=\".svg\"]{width:48px}.elementor-widget-image img{vertical-align:middle;display:inline-block}<\/style>\t\t\t\t\t\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"583\" height=\"306\" src=\"https:\/\/cybercrime.rs\/wp-content\/uploads\/2023\/07\/1_Xleh0prSapeXzW5SQ8KyhQ.webp\" class=\"attachment-large size-large\" alt=\"\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-bd17fd9 elementor-widget elementor-widget-text-editor\" data-id=\"bd17fd9\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<ul>\n<li>Reconnaissance:\u00a0The observation stage where attackers assess your network and services to identify possible targets and techniques to gain entry.<\/li>\n<li>Intrusion:\u00a0Attackers use knowledge gained in the reconnaissance phase to get access to a part of your network. This often involves exploring a flaw or security hole.<\/li>\n<li>Exploitation:\u00a0This phase involves exploiting vulnerabilities and inserting malicious code onto the system to get more access.<\/li>\n<li>Privilege Escalation: Attackers often try to gain administrative access to compromised systems so they can get access to more critical data and move into other connected systems.<\/li>\n<li>Lateral Movement: This is the act of moving laterally to connected servers and gain greater access to potential data.<\/li>\n<li>Obfuscation \/ Anti-forensics:\u00a0To successfully pull off a cyberattack, attackers need to cover their entry. They will often compromise data and clear audit logs to try to prevent detection by any security team.<\/li>\n<li>Denial of Service:\u00a0This phase involves disruption of normal access for users and systems to keep the attack from being monitored, tracked, or blocked.<\/li>\n<li>Exfiltration:\u00a0The final extraction stage: getting valuable data out of the compromised systems.<\/li>\n<\/ul>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9306aaa elementor-widget elementor-widget-spacer\" data-id=\"9306aaa\" data-element_type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-f4c0bb7 elementor-widget elementor-widget-heading\" data-id=\"f4c0bb7\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Threat Hunting Tools and Methodology<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-b86ba33 elementor-widget elementor-widget-spacer\" data-id=\"b86ba33\" data-element_type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-6578beb elementor-widget elementor-widget-text-editor\" data-id=\"6578beb\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>To ensure maximum visibility of the attack chain, hunters use data sourced from proprietary incident response tooling for\u00a0point-in-time deep scanning\u00a0on endpoints, as well as bespoke forensic triage tools on devices of interest.<\/p>\n<p>For <span style=\"color: #ffffff;\">point-in-time deep scanning<\/span>, for forensic investigations uses:<\/p>\n<ul>\n<li>Proprietary incident response tooling for Windows and Linux.<\/li>\n<li>Forensic triage tool on devices of interest.<\/li>\n<li><a href=\"https:\/\/azure.microsoft.com\/services\/active-directory\/\" target=\"_blank\" rel=\"noopener\"><span style=\"color: #ead181;\">Microsoft Azure Active Directory<\/span><\/a>\u00a0(Azure AD) security and configuration assessment.<\/li>\n<\/ul>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-a341b35 elementor-widget elementor-widget-image\" data-id=\"a341b35\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"700\" height=\"420\" src=\"https:\/\/cybercrime.rs\/wp-content\/uploads\/2023\/07\/2-1.png\" class=\"attachment-large size-large\" alt=\"\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-41c03b9 elementor-widget elementor-widget-text-editor\" data-id=\"41c03b9\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>For <span style=\"color: #ffffff;\">continuous monitoring<\/span>:<\/p>\n<ul>\n<li><a href=\"https:\/\/azure.microsoft.com\/services\/microsoft-sentinel\/\" target=\"_blank\" rel=\"noopener\"><span style=\"color: #ead181;\">Microsoft Sentinel<\/span><\/a>\u00a0\u2014 Provides centralized source of event logging. Uses machine learning and artificial intelligence.<\/li>\n<li><a href=\"https:\/\/www.microsoft.com\/security\/business\/endpoint-security\/microsoft-defender-endpoint\" target=\"_blank\" rel=\"noopener\"><span style=\"color: #ead181;\">Microsoft Defender for Endpoint<\/span><\/a>\u00a0\u2014 For behavioral, process-level detection. Uses machine learning and artificial intelligence to quickly respond to threats while working side-by-side with third-party antivirus vendors.<\/li>\n<li><a href=\"https:\/\/www.microsoft.com\/security\/business\/siem-and-xdr\/microsoft-defender-for-identity\" target=\"_blank\" rel=\"noopener\"><span style=\"color: #ead181;\">Microsoft Defender for Identity<\/span><\/a>\u00a0\u2014 For detection of common threats and analysis of authentication requests. It examines authentication requests to Azure AD from all operating systems and uses machine learning and artificial intelligence to quickly report many types of threats, such as pass-the-hash, golden and silver ticket, skeleton key, and many more.<\/li>\n<li><a href=\"https:\/\/www.microsoft.com\/security\/business\/siem-and-xdr\/microsoft-defender-cloud-apps\" target=\"_blank\" rel=\"noopener\"><span style=\"color: #ead181;\">Microsoft Defender for Cloud Apps<\/span><\/a>\u00a0\u2014 Cloud Access Security Broker (CASB) that supports various deployment modes including log collection, API connectors, and reverse proxy. It provides rich visibility, control over data travel, and sophisticated analytics to identify and combat cyberthreats across all your Microsoft and third-party cloud services.<\/li>\n<li>Deep scan includes proprietary endpoint scanners such as ASEP, Fennec, LIFE, and FoX<\/li>\n<li>Enterprise data includes Active Directory Configuration and Antivirus logs.<\/li>\n<li>Global telemetry includes the Intelligent Security Graph, the largest sensor network in the world.<\/li>\n<\/ul>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-79108e1 elementor-widget elementor-widget-text-editor\" data-id=\"79108e1\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Continuous monitoring includes the following:<\/p>\n<ul>\n<li>Microsoft Defender for Office 365, which monitors spoofing impersonation, and content analysis.<\/li>\n<li>Microsoft Defender for Cloud Apps, which monitors app discovery, access management, and data loss prevention.<\/li>\n<li>Microsoft Defender for Endpoint, which monitors exploitation, installation, and command and control channel.<\/li>\n<li>Microsoft Defender for Identity, which monitors reconnaissance, lateral movement, and domain dominance.<\/li>\n<li>Microsoft 365 Defender, Microsoft Sentinel, and Microsoft Defender for Cloud, which include advanced hunting, alerting, and correlation across data sources.<\/li>\n<\/ul>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-c67bac5 elementor-widget elementor-widget-image\" data-id=\"c67bac5\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"646\" height=\"353\" src=\"https:\/\/cybercrime.rs\/wp-content\/uploads\/2023\/07\/3-1.png\" class=\"attachment-large size-large\" alt=\"\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9c5cddf elementor-widget elementor-widget-text-editor\" data-id=\"9c5cddf\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>This is example Hunting through the Attach chain:<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-372deea elementor-widget elementor-widget-image\" data-id=\"372deea\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"700\" height=\"396\" src=\"https:\/\/cybercrime.rs\/wp-content\/uploads\/2023\/07\/4-1.png\" class=\"attachment-large size-large\" alt=\"\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-6581163 elementor-widget elementor-widget-spacer\" data-id=\"6581163\" data-element_type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-1e16931 elementor-widget elementor-widget-heading\" data-id=\"1e16931\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Starting with IOCs (\u201cknown bads\u201d)<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-c373510 elementor-widget elementor-widget-spacer\" data-id=\"c373510\" data-element_type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-e40d9f0 elementor-blockquote--skin-border elementor-blockquote--button-color-official elementor-widget elementor-widget-blockquote\" data-id=\"e40d9f0\" data-element_type=\"widget\" data-widget_type=\"blockquote.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor-pro - v3.7.7 - 20-09-2022 *\/\n@charset \"UTF-8\";.entry-content blockquote.elementor-blockquote:not(.alignright):not(.alignleft),.entry-summary blockquote.elementor-blockquote{margin-right:0;margin-left:0}.elementor-widget-blockquote blockquote{margin:0;padding:0;outline:0;font-size:100%;vertical-align:baseline;background:transparent;quotes:none;border:0;font-style:normal;color:#55595c}.elementor-widget-blockquote blockquote:after,.elementor-widget-blockquote blockquote:before,.elementor-widget-blockquote blockquote cite:after,.elementor-widget-blockquote blockquote cite:before,.elementor-widget-blockquote blockquote footer:after,.elementor-widget-blockquote blockquote footer:before{content:\"\";content:none}.elementor-blockquote{-webkit-transition:.3s;-o-transition:.3s;transition:.3s}.elementor-blockquote__author,.elementor-blockquote__content{margin-bottom:0;font-style:normal}.elementor-blockquote__author{font-weight:700}.elementor-blockquote footer{margin-top:12px;display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-pack:justify;-ms-flex-pack:justify;justify-content:space-between}.elementor-blockquote__tweet-button{display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-transition:.3s;-o-transition:.3s;transition:.3s;color:#1da1f2;-ms-flex-item-align:end;align-self:flex-end;line-height:1;position:relative;width:-webkit-max-content;width:-moz-max-content;width:max-content}.elementor-blockquote__tweet-button:hover{color:#0967a0}.elementor-blockquote__tweet-button span{font-weight:600}.elementor-blockquote__tweet-button i,.elementor-blockquote__tweet-button span{vertical-align:middle}.elementor-blockquote__tweet-button i+span,.elementor-blockquote__tweet-button svg+span{margin-left:.5em}.elementor-blockquote__tweet-button svg{fill:#1da1f2;height:1em;width:1em}.elementor-blockquote__tweet-label{white-space:pre-wrap}.elementor-blockquote--button-skin-bubble .elementor-blockquote__tweet-button,.elementor-blockquote--button-skin-classic .elementor-blockquote__tweet-button{padding:.7em 1.2em;border-radius:100em;background-color:#1da1f2;color:#fff;font-size:15px}.elementor-blockquote--button-skin-bubble .elementor-blockquote__tweet-button:hover,.elementor-blockquote--button-skin-classic .elementor-blockquote__tweet-button:hover{background-color:#0967a0;color:#fff}.elementor-blockquote--button-skin-bubble .elementor-blockquote__tweet-button:hover:before,.elementor-blockquote--button-skin-classic .elementor-blockquote__tweet-button:hover:before{border-right-color:#0967a0}.elementor-blockquote--button-skin-bubble .elementor-blockquote__tweet-button svg,.elementor-blockquote--button-skin-classic .elementor-blockquote__tweet-button svg{fill:#fff;height:1em;width:1em}.elementor-blockquote--button-skin-bubble.elementor-blockquote--button-view-icon .elementor-blockquote__tweet-button,.elementor-blockquote--button-skin-classic.elementor-blockquote--button-view-icon .elementor-blockquote__tweet-button{padding:0;width:2em;height:2em}.elementor-blockquote--button-skin-bubble.elementor-blockquote--button-view-icon .elementor-blockquote__tweet-button i,.elementor-blockquote--button-skin-classic.elementor-blockquote--button-view-icon .elementor-blockquote__tweet-button i{position:absolute;left:50%;top:50%;-webkit-transform:translate(-50%,-50%);-ms-transform:translate(-50%,-50%);transform:translate(-50%,-50%)}.elementor-blockquote--button-skin-bubble .elementor-blockquote__tweet-button:before{content:\"\";border:.5em solid transparent;border-right-color:#1da1f2;position:absolute;left:-.8em;top:50%;-webkit-transform:translateY(-50%) scaleY(.65);-ms-transform:translateY(-50%) scaleY(.65);transform:translateY(-50%) scaleY(.65);-webkit-transition:.3s;-o-transition:.3s;transition:.3s}.elementor-blockquote--button-skin-bubble.elementor-blockquote--align-left .elementor-blockquote__tweet-button:before{right:auto;left:-.8em;border-right-color:#1da1f2;border-left-color:transparent}.elementor-blockquote--button-skin-bubble.elementor-blockquote--align-left .elementor-blockquote__tweet-button:hover:before{border-right-color:#0967a0}.elementor-blockquote--button-skin-bubble.elementor-blockquote--align-right .elementor-blockquote__tweet-button:before{left:auto;right:-.8em;border-right-color:transparent;border-left-color:#1da1f2}.elementor-blockquote--button-skin-bubble.elementor-blockquote--align-right .elementor-blockquote__tweet-button:hover:before{border-left-color:#0967a0}.elementor-blockquote--skin-boxed .elementor-blockquote{background-color:#e6e9ec;padding:30px}.elementor-blockquote--skin-border .elementor-blockquote{border-color:#e6e9ec;border-left:7px #e6e9ec;border-style:solid;padding-left:20px}.elementor-blockquote--skin-quotation .elementor-blockquote:before{content:\"\u201c\";font-size:100px;color:#e6e9ec;font-family:Times New Roman,Times,serif;font-weight:900;line-height:1;display:block;height:.6em}.elementor-blockquote--skin-quotation .elementor-blockquote__content{margin-top:15px}.elementor-blockquote--align-left .elementor-blockquote__content{text-align:left}.elementor-blockquote--align-left .elementor-blockquote footer{-webkit-box-orient:horizontal;-webkit-box-direction:normal;-ms-flex-direction:row;flex-direction:row}.elementor-blockquote--align-right .elementor-blockquote__content{text-align:right}.elementor-blockquote--align-right .elementor-blockquote footer{-webkit-box-orient:horizontal;-webkit-box-direction:reverse;-ms-flex-direction:row-reverse;flex-direction:row-reverse}.elementor-blockquote--align-center .elementor-blockquote{text-align:center}.elementor-blockquote--align-center .elementor-blockquote__author,.elementor-blockquote--align-center .elementor-blockquote footer{display:block}.elementor-blockquote--align-center .elementor-blockquote__tweet-button{margin-right:auto;margin-left:auto}<\/style>\t\t<blockquote class=\"elementor-blockquote\">\n\t\t\t<p class=\"elementor-blockquote__content\">\n\t\t\t\tThe hunting cycle starts with hunting for indicators or \u201cknown bads,\u201d ranging from the smallest unit of indicators to behavioral indicators that may define the actor.\t\t\t<\/p>\n\t\t\t\t\t<\/blockquote>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-0ab3fbc elementor-widget elementor-widget-text-editor\" data-id=\"0ab3fbc\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>An incident response investigation is more manageable when you start off with an initial indicator of compromise (IOC) trigger, or a \u201cknown bad,\u201d to take you to any additional findings. We typically begin with data reduction techniques to limit the data we\u2019re looking at. One example is data stacking, which helps us filter and sort out forensic artifacts by indicator across the enterprise environment until we\u2019ve determined that several machines across the same environment have been confirmed with that same IOC trigger. We then enter the hunting flow and rinse and repeat this process.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-a242cb4 elementor-widget elementor-widget-image\" data-id=\"a242cb4\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"488\" height=\"352\" src=\"https:\/\/cybercrime.rs\/wp-content\/uploads\/2023\/07\/5-1.png\" class=\"attachment-large size-large\" alt=\"\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-4de1fe3 elementor-widget elementor-widget-text-editor\" data-id=\"4de1fe3\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>When a security incident is detected on the Azure cloud platform, investigators must examine the log data collected from various sources. If a VM is found to be affected, it is important to take a snapshot of the OS disk of the VM for further investigation. This section discusses the forensic acquisition methodology of an Azure VM and discusses an assumed scenario to divide the whole process into multiple steps.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-a29a346 elementor-widget elementor-widget-text-editor\" data-id=\"a29a346\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Virtual machine acquisition on the Azure cloud platform includes the following steps:<\/p>\n<ol>\n<li>Create a snapshot of the OS disk of the suspect VM via Azure portal or Azure CLI<\/li>\n<li>Copy the snapshot to a storage account under different resource groups where it can be stored for forensic analysis<\/li>\n<li>Delete the snapshot from the source resource group and create a backup copy<\/li>\n<li>Mount the snapshot onto the forensic workstation<\/li>\n<\/ol>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-399c151 elementor-widget elementor-widget-text-editor\" data-id=\"399c151\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>DFIR Scenario:<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-e5efa87 elementor-widget elementor-widget-text-editor\" data-id=\"e5efa87\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>In my environment I created two resource group in the same Azure Subscription:<\/p>\n<ol>\n<li>Uros-PROD for production enviroment<\/li>\n<li>SECURITY-UROS for DFIR investigations<\/li>\n<li>Under Uros-PROD resource group there is VM called Ubuntu-Uros which is suspected to be compromised<\/li>\n<\/ol>\n<p>As a forensics investigator I need to take snapshot of the OS disk of the suspected VM Ubuntu -Uros for further DIFR investigations:<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ef36c09 elementor-widget elementor-widget-image\" data-id=\"ef36c09\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"700\" height=\"379\" src=\"https:\/\/cybercrime.rs\/wp-content\/uploads\/2023\/07\/6-1.png\" class=\"attachment-large size-large\" alt=\"\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ac718f7 elementor-widget elementor-widget-text-editor\" data-id=\"ac718f7\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"color: #ffffff;\">Step 1:<\/span> Create Snapshot of the OS disk of the affected VM in Azure Portal<\/p>\n<p>Shut down th VM Ubuntu-Uros whose snapshot needs to be created<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-cb48bd6 elementor-widget elementor-widget-image\" data-id=\"cb48bd6\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"700\" height=\"382\" src=\"https:\/\/cybercrime.rs\/wp-content\/uploads\/2023\/07\/7-1.png\" class=\"attachment-large size-large\" alt=\"\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-f6c7ed4 elementor-widget elementor-widget-text-editor\" data-id=\"f6c7ed4\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"color: #ffffff;\">Step 2:<\/span> Locate Ubuntu Ubuntu-Uros_OsDisk from Uros-PROD resource group<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-58d23fc elementor-widget elementor-widget-image\" data-id=\"58d23fc\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"700\" height=\"340\" src=\"https:\/\/cybercrime.rs\/wp-content\/uploads\/2023\/07\/8.png\" class=\"attachment-large size-large\" alt=\"\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-fedaa0a elementor-widget elementor-widget-text-editor\" data-id=\"fedaa0a\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"color: #ffffff;\">Step 3:<\/span> Click on Snapshot button<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-be6e3b5 elementor-widget elementor-widget-image\" data-id=\"be6e3b5\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"700\" height=\"392\" src=\"https:\/\/cybercrime.rs\/wp-content\/uploads\/2023\/07\/9.png\" class=\"attachment-large size-large\" alt=\"\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9e1d716 elementor-widget elementor-widget-text-editor\" data-id=\"9e1d716\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"color: #ffffff;\">Step 4:<\/span> Create snapshot of the OS disk on the Affected VM Ubuntu -UrosGive desired name of OS snapshot (urosubuntudisksnap)storage type standard HDD<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-16cad90 elementor-widget elementor-widget-image\" data-id=\"16cad90\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"700\" height=\"377\" src=\"https:\/\/cybercrime.rs\/wp-content\/uploads\/2023\/07\/10.png\" class=\"attachment-large size-large\" alt=\"\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-62d4d88 elementor-widget elementor-widget-text-editor\" data-id=\"62d4d88\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"color: #ffffff;\">Step 5:<\/span> urosubuntudisksnap snapshot is successfully created<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9fd5cbc elementor-widget elementor-widget-image\" data-id=\"9fd5cbc\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"700\" height=\"410\" src=\"https:\/\/cybercrime.rs\/wp-content\/uploads\/2023\/07\/11.png\" class=\"attachment-large size-large\" alt=\"\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ca64e0b elementor-widget elementor-widget-text-editor\" data-id=\"ca64e0b\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"color: #ffffff;\">Step 6:<\/span> Mount the snapshot onto the forensic workstation:<\/p>\n<p>Open File Explorer from the Start Menu or press Win+E key togetherSelect This PC from the left-side menu, click on Computer, and select Map Network DriveSelect the drive letter and provide the UNC path in file shareIf prompted, provide the storage account name as username and storage key as passwordThe file share chfishare is now mounted under Network Locations . Double-click on the mounted share to view the dd file<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ed442c4 elementor-widget elementor-widget-image\" data-id=\"ed442c4\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"700\" height=\"290\" src=\"https:\/\/cybercrime.rs\/wp-content\/uploads\/2023\/07\/12.png\" class=\"attachment-large size-large\" alt=\"\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-32ca657 elementor-widget elementor-widget-text-editor\" data-id=\"32ca657\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"color: #ffffff;\">Step 7:<\/span> Analyze the Snapshot via Autopsy<\/p>\n<p>Once the file share containing the disksnapshot.dd file is mounted on the Forensic workstation, you can conduct forensic examination on the contents of the OS disk of the affected VM via tools like Autopsy<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-a19450a elementor-widget elementor-widget-image\" data-id=\"a19450a\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"700\" height=\"348\" src=\"https:\/\/cybercrime.rs\/wp-content\/uploads\/2023\/07\/13.png\" class=\"attachment-large size-large\" alt=\"\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-336117c elementor-widget elementor-widget-spacer\" data-id=\"336117c\" data-element_type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-f560c7a elementor-widget elementor-widget-heading\" data-id=\"f560c7a\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">RECOMMENDATIONS AND BEST PRACTICES:<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-518dc7d elementor-widget elementor-widget-spacer\" data-id=\"518dc7d\" data-element_type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-01cade2 elementor-widget elementor-widget-heading\" data-id=\"01cade2\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Recommendations for devices<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-abaf8a1 elementor-widget elementor-widget-spacer\" data-id=\"abaf8a1\" data-element_type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-6a847b5 elementor-blockquote--skin-border elementor-blockquote--button-color-official elementor-widget elementor-widget-blockquote\" data-id=\"6a847b5\" data-element_type=\"widget\" data-widget_type=\"blockquote.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<blockquote class=\"elementor-blockquote\">\n\t\t\t<p class=\"elementor-blockquote__content\">\n\t\t\t\tActive Directory Hardening\t\t\t<\/p>\n\t\t\t\t\t<\/blockquote>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-1162068 elementor-widget elementor-widget-text-editor\" data-id=\"1162068\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>You should review the\u00a0<span style=\"color: #ead181;\"><a style=\"color: #ead181;\" href=\"https:\/\/docs.microsoft.com\/en-us\/windows-server\/identity\/securing-privileged-access\/securing-privileged-access-reference-material\" target=\"_blank\" rel=\"noopener\">Active Directory Administrative Tier model\u00a0<\/a><\/span>(0\/1\/2), Restrict Service Accounts from interactive logins.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-e7bc06f elementor-widget elementor-widget-image\" data-id=\"e7bc06f\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"700\" height=\"338\" src=\"https:\/\/cybercrime.rs\/wp-content\/uploads\/2023\/07\/14.jpg\" class=\"attachment-large size-large\" alt=\"\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-e1b891e elementor-widget elementor-widget-text-editor\" data-id=\"e1b891e\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Use MSA or GMSA for Service Accounts<\/p>\n<p>Standardize DCs and reduce attack surface<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-b58e841 elementor-blockquote--skin-border elementor-blockquote--button-color-official elementor-widget elementor-widget-blockquote\" data-id=\"b58e841\" data-element_type=\"widget\" data-widget_type=\"blockquote.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<blockquote class=\"elementor-blockquote\">\n\t\t\t<p class=\"elementor-blockquote__content\">\n\t\t\t\tMicrosoft Defender for Endpoint\t\t\t<\/p>\n\t\t\t\t\t<\/blockquote>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-18a9587 elementor-widget elementor-widget-text-editor\" data-id=\"18a9587\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Enroll 100% of devices in Microsoft Defender for Endpoint<\/p>\n<p>Actively monitor alerts and quickly take action on issues in the console<\/p>\n<p>Leverage Microsoft Threat Experts for help monitoring advanced attacks<\/p>\n<p>Regularly review Threat and Vulnerability Management and follow remediation steps, starting with most critical to your organization<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-37c70f2 elementor-blockquote--skin-border elementor-blockquote--button-color-official elementor-widget elementor-widget-blockquote\" data-id=\"37c70f2\" data-element_type=\"widget\" data-widget_type=\"blockquote.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<blockquote class=\"elementor-blockquote\">\n\t\t\t<p class=\"elementor-blockquote__content\">\n\t\t\t\tPatching\t\t\t<\/p>\n\t\t\t\t\t<\/blockquote>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-666db9f elementor-widget elementor-widget-text-editor\" data-id=\"666db9f\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Implement a comprehensive patching strategy across all systems, for both Microsoft and 3rd party products.\u00a0This is critical.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-03e65cd elementor-blockquote--skin-border elementor-blockquote--button-color-official elementor-widget elementor-widget-blockquote\" data-id=\"03e65cd\" data-element_type=\"widget\" data-widget_type=\"blockquote.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<blockquote class=\"elementor-blockquote\">\n\t\t\t<p class=\"elementor-blockquote__content\">\n\t\t\t\tWindows 10 Hygiene\t\t\t<\/p>\n\t\t\t\t\t<\/blockquote>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-f019f8e elementor-widget elementor-widget-text-editor\" data-id=\"f019f8e\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Tighten up\u00a0<a href=\"https:\/\/securitycenter.windows.com\/software-inventory\/microsoft-_-windows_10\/versions\" target=\"_blank\" rel=\"noopener\"><span style=\"color: #ead181;\">Windows 10 build to N-1<\/span>.<\/a><\/p>\n<p>Enable Credential\/Device\/Exploit Guard, Windows Hello for Business, SmartScreen, Application Control, Controlled Folder Access, Attack Surface Reduction, BitLocker, Secure Boot, etc.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-20a874c elementor-blockquote--skin-border elementor-blockquote--button-color-official elementor-widget elementor-widget-blockquote\" data-id=\"20a874c\" data-element_type=\"widget\" data-widget_type=\"blockquote.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<blockquote class=\"elementor-blockquote\">\n\t\t\t<p class=\"elementor-blockquote__content\">\n\t\t\t\tWindows Firewall\t\t\t<\/p>\n\t\t\t\t\t<\/blockquote>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-3884e15 elementor-widget elementor-widget-text-editor\" data-id=\"3884e15\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Ensure this is enabled on 100% of computers via Group Policy.\u00a0This greatly reduces lateral movement attack surface<\/p>\n<p>Block all the incoming connection on the clients (manage the exceptions for Help Desk access)<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-c0e59cd elementor-widget elementor-widget-spacer\" data-id=\"c0e59cd\" data-element_type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-160f4f5 elementor-widget elementor-widget-heading\" data-id=\"160f4f5\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Recommendations for identity<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-e12260d elementor-widget elementor-widget-spacer\" data-id=\"e12260d\" data-element_type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-a25e5dd elementor-blockquote--skin-border elementor-blockquote--button-color-official elementor-widget elementor-widget-blockquote\" data-id=\"a25e5dd\" data-element_type=\"widget\" data-widget_type=\"blockquote.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<blockquote class=\"elementor-blockquote\">\n\t\t\t<p class=\"elementor-blockquote__content\">\n\t\t\t\tManage Legacy protocols\t\t\t<\/p>\n\t\t\t\t\t<\/blockquote>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9461a50 elementor-widget elementor-widget-text-editor\" data-id=\"9461a50\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Inventory &amp; Disable SMBv1<\/p>\n<p>Inventory &amp; Disable NTLM<\/p>\n<p>Inventory &amp; Discontinue use of TLS 1.0 and 1.1 (EOL \u2018Spring 2021\u2019)<\/p>\n<p>Update\u00a0all\u00a0services &amp; apps which use SMTP, Telnet, FTP, IMAP, etc. to modern non-clear-text alternatives. This is\u00a0required\u00a0to disable Legacy Authentication in Office 365, which is required for Conditional Access<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-7efa108 elementor-blockquote--skin-border elementor-blockquote--button-color-official elementor-widget elementor-widget-blockquote\" data-id=\"7efa108\" data-element_type=\"widget\" data-widget_type=\"blockquote.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<blockquote class=\"elementor-blockquote\">\n\t\t\t<p class=\"elementor-blockquote__content\">\n\t\t\t\tStrong Authentication\t\t\t<\/p>\n\t\t\t\t\t<\/blockquote>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-5f0857b elementor-widget elementor-widget-text-editor\" data-id=\"5f0857b\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>A username and password is no longer enough. Use technologies such as Passwordless, Hello for Business, FIDO, Azure AD MFA or OATH tokens to enforce Strong Authentication for all signings.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-76928fa elementor-blockquote--skin-border elementor-blockquote--button-color-official elementor-widget elementor-widget-blockquote\" data-id=\"76928fa\" data-element_type=\"widget\" data-widget_type=\"blockquote.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<blockquote class=\"elementor-blockquote\">\n\t\t\t<p class=\"elementor-blockquote__content\">\n\t\t\t\tCentralize Logging\t\t\t<\/p>\n\t\t\t\t\t<\/blockquote>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-99289b3 elementor-widget elementor-widget-text-editor\" data-id=\"99289b3\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Ensure that sign in data flows to a central location for detailed analysis and enrichment<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-55e628a elementor-blockquote--skin-border elementor-blockquote--button-color-official elementor-widget elementor-widget-blockquote\" data-id=\"55e628a\" data-element_type=\"widget\" data-widget_type=\"blockquote.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<blockquote class=\"elementor-blockquote\">\n\t\t\t<p class=\"elementor-blockquote__content\">\n\t\t\t\tJust-in-time administration\t\t\t<\/p>\n\t\t\t\t\t<\/blockquote>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-6f9f686 elementor-widget elementor-widget-text-editor\" data-id=\"6f9f686\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Where possible, enforce just-in-time access for administration, using solutions like Privileged Identity Management for Azure AD or Privileged Access Management for Active Directory<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-2d8b566 elementor-widget elementor-widget-image\" data-id=\"2d8b566\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"700\" height=\"389\" src=\"https:\/\/cybercrime.rs\/wp-content\/uploads\/2023\/07\/15.png\" class=\"attachment-large size-large\" alt=\"\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-6df59b4 elementor-blockquote--skin-border elementor-blockquote--button-color-official elementor-widget elementor-widget-blockquote\" data-id=\"6df59b4\" data-element_type=\"widget\" data-widget_type=\"blockquote.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<blockquote class=\"elementor-blockquote\">\n\t\t\t<p class=\"elementor-blockquote__content\">\n\t\t\t\tCredential Hygiene\t\t\t<\/p>\n\t\t\t\t\t<\/blockquote>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-5afe6c0 elementor-widget elementor-widget-text-editor\" data-id=\"5afe6c0\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Continue Credential Hygiene Best Practices<\/p>\n<p><a href=\"http:\/\/www.aka.ms\/tier0\" target=\"_blank\" rel=\"noopener\"><span style=\"color: #ead181;\">www.aka.ms\/tier0<\/span>\u00a0<\/a>for reference materials<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-7cea1c0 elementor-widget elementor-widget-spacer\" data-id=\"7cea1c0\" data-element_type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-823c89d elementor-widget elementor-widget-heading\" data-id=\"823c89d\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Recommendations for access<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-dc3a877 elementor-widget elementor-widget-spacer\" data-id=\"dc3a877\" data-element_type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-314e3c1 elementor-blockquote--skin-border elementor-blockquote--button-color-official elementor-widget elementor-widget-blockquote\" data-id=\"314e3c1\" data-element_type=\"widget\" data-widget_type=\"blockquote.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<blockquote class=\"elementor-blockquote\">\n\t\t\t<p class=\"elementor-blockquote__content\">\n\t\t\t\tRisk based access\t\t\t<\/p>\n\t\t\t\t\t<\/blockquote>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-19eb7ba elementor-widget elementor-widget-text-editor\" data-id=\"19eb7ba\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Consider using the risk level of users and devices as a condition for accessing corporate systems<\/p>\n<p>Block access or require higher level of confidence for users and\/or devices based on risky activities<\/p>\n<p>Requires Azure AD Identity Protection and \/ or Intune and MDE enrolment<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-aab5792 elementor-blockquote--skin-border elementor-blockquote--button-color-official elementor-widget elementor-widget-blockquote\" data-id=\"aab5792\" data-element_type=\"widget\" data-widget_type=\"blockquote.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<blockquote class=\"elementor-blockquote\">\n\t\t\t<p class=\"elementor-blockquote__content\">\n\t\t\t\tRemote Tools & VPN\t\t\t<\/p>\n\t\t\t\t\t<\/blockquote>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d5fa045 elementor-widget elementor-widget-text-editor\" data-id=\"d5fa045\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Remote access tools were identified. Ensure that 100% of these are managed &amp; monitored for legitimate usage<\/p>\n<p>Ensure VPN clients are legitimate &amp; monitored, and MFA is required<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-a28cdca elementor-blockquote--skin-border elementor-blockquote--button-color-official elementor-widget elementor-widget-blockquote\" data-id=\"a28cdca\" data-element_type=\"widget\" data-widget_type=\"blockquote.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<blockquote class=\"elementor-blockquote\">\n\t\t\t<p class=\"elementor-blockquote__content\">\n\t\t\t\tMonitor & Audit MSSP\t\t\t<\/p>\n\t\t\t\t\t<\/blockquote>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d4b42cb elementor-widget elementor-widget-text-editor\" data-id=\"d4b42cb\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Perform regular audits of any external vendors management and activity<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ad0c0b5 elementor-blockquote--skin-border elementor-blockquote--button-color-official elementor-widget elementor-widget-blockquote\" data-id=\"ad0c0b5\" data-element_type=\"widget\" data-widget_type=\"blockquote.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<blockquote class=\"elementor-blockquote\">\n\t\t\t<p class=\"elementor-blockquote__content\">\n\t\t\t\tPrivileged Access Workstation (PAW)\t\t\t<\/p>\n\t\t\t\t\t<\/blockquote>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-af7523f elementor-widget elementor-widget-text-editor\" data-id=\"af7523f\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Securing privileged access is a critical first step to establishing security assurances for business assets in a modern organization. The security of most or all business assets in an IT organization depends on the integrity of the privileged accounts used to administer, manage, and develop.<\/p>\n<p>This above figure shows how reversing the control relationship and accessing user apps from an admin workstation gives the attacker no path to the targeted object. The user jump box is still exposed to risk so appropriate protective controls, detective controls, and response processes should still be applied for that internet-facing computer.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-8ab0354 elementor-widget elementor-widget-image\" data-id=\"8ab0354\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"700\" height=\"122\" src=\"https:\/\/cybercrime.rs\/wp-content\/uploads\/2023\/07\/16.png\" class=\"attachment-large size-large\" alt=\"\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ceec917 elementor-widget elementor-widget-text-editor\" data-id=\"ceec917\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Securing privileged access is a critical first step to establishing security assurances for business assets in a modern organization. The security of most or all business assets in an IT organization depends on the integrity of the privileged accounts used to administer, manage, and develop.<\/p>\n<p>Plan deployment of Privileged Admin Workstation (PAW) for EA\/DA T0, T1, and Azure admins.<\/p>\n<p>Monitor T0 accounts and audit usage regularly.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ded9141 elementor-widget elementor-widget-spacer\" data-id=\"ded9141\" data-element_type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-541b88b elementor-widget elementor-widget-heading\" data-id=\"541b88b\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Recommendations for cloud<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9d84beb elementor-widget elementor-widget-spacer\" data-id=\"9d84beb\" data-element_type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-40f5f78 elementor-blockquote--skin-border elementor-blockquote--button-color-official elementor-widget elementor-widget-blockquote\" data-id=\"40f5f78\" data-element_type=\"widget\" data-widget_type=\"blockquote.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<blockquote class=\"elementor-blockquote\">\n\t\t\t<p class=\"elementor-blockquote__content\">\n\t\t\t\tUser Entity Behavioral Analytics (UEBA)\t\t\t<\/p>\n\t\t\t\t\t<\/blockquote>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-54c35e8 elementor-widget elementor-widget-text-editor\" data-id=\"54c35e8\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Use Cloud App Security and Azure AD Identity Protection to identify anomalous user activity.<\/p>\n<p>Manage and respond to alerts regularly to help train the systems.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-c52116f elementor-blockquote--skin-border elementor-blockquote--button-color-official elementor-widget elementor-widget-blockquote\" data-id=\"c52116f\" data-element_type=\"widget\" data-widget_type=\"blockquote.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<blockquote class=\"elementor-blockquote\">\n\t\t\t<p class=\"elementor-blockquote__content\">\n\t\t\t\tAzure Security Center\t\t\t<\/p>\n\t\t\t\t\t<\/blockquote>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-58e2069 elementor-widget elementor-widget-text-editor\" data-id=\"58e2069\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Monitor and manage IaaS and PaaS security configurations to protect cloud workloads. Use Insights and Recommendations to prioritize and plan remediation activities<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-57b2977 elementor-blockquote--skin-border elementor-blockquote--button-color-official elementor-widget elementor-widget-blockquote\" data-id=\"57b2977\" data-element_type=\"widget\" data-widget_type=\"blockquote.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<blockquote class=\"elementor-blockquote\">\n\t\t\t<p class=\"elementor-blockquote__content\">\n\t\t\t\tAzure Monitor + Defender for Cloud + Sentinel+XDR\t\t\t<\/p>\n\t\t\t\t\t<\/blockquote>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-b282f5b elementor-widget elementor-widget-text-editor\" data-id=\"b282f5b\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Microsoft Sentinel is a cloud-native SIEM tool; Microsoft 365 Defender provides XDR capabilities for end-user environments (email, documents, Microsoft Teams, identity, apps, and endpoint); and Microsoft Defender for Cloud provides XDR capabilities for infrastructure and multicloud platforms including virtual machines, databases, containers, storage, and IoT. Altogether, the security operations team gets a fully integrated solution to prevent, detect, respond to, and protect against attacks.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-549bdcb elementor-widget elementor-widget-image\" data-id=\"549bdcb\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"700\" height=\"492\" src=\"https:\/\/cybercrime.rs\/wp-content\/uploads\/2023\/07\/17.png\" class=\"attachment-large size-large\" alt=\"\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-991b2ac elementor-blockquote--skin-border elementor-blockquote--button-color-official elementor-widget elementor-widget-blockquote\" data-id=\"991b2ac\" data-element_type=\"widget\" data-widget_type=\"blockquote.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<blockquote class=\"elementor-blockquote\">\n\t\t\t<p class=\"elementor-blockquote__content\">\n\t\t\t\tMicrosoft 365 security center\t\t\t<\/p>\n\t\t\t\t\t<\/blockquote>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-3f44168 elementor-widget elementor-widget-text-editor\" data-id=\"3f44168\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Benefit from a combined incident queue, correlation of signals across cloud services and configuration management for multiple platforms in one place.<\/p>\n<p><span style=\"color: #ead181;\"><a style=\"color: #ead181;\" href=\"https:\/\/security.microsoft.com\/\" target=\"_blank\" rel=\"noopener\">https:\/\/security.microsoft.com<\/a><\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d260f5d elementor-blockquote--skin-border elementor-blockquote--button-color-official elementor-widget elementor-widget-blockquote\" data-id=\"d260f5d\" data-element_type=\"widget\" data-widget_type=\"blockquote.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<blockquote class=\"elementor-blockquote\">\n\t\t\t<p class=\"elementor-blockquote__content\">\n\t\t\t\tMicrosoft Defender for Office 365\t\t\t<\/p>\n\t\t\t\t\t<\/blockquote>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-7faa64f elementor-widget elementor-widget-text-editor\" data-id=\"7faa64f\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Use behavioral analysis of emails, attachments and files to protect Office 365 from zero day or polymorphic threats.<\/p>\n<p>Anti-Phishing policies help protect against user or domain impersonation.<\/p>\n<p>Regularly review and respond to alerts in the Microsoft 365 security center and train end-users with Attack Simulation training modules.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-8368586 elementor-widget elementor-widget-spacer\" data-id=\"8368586\" data-element_type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-a07e59c elementor-widget elementor-widget-heading\" data-id=\"a07e59c\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">SMB \u2014 Preventing SMB traffic<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-fd74a54 elementor-widget elementor-widget-spacer\" data-id=\"fd74a54\" data-element_type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-4e35499 elementor-widget elementor-widget-text-editor\" data-id=\"4e35499\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Because SMB is a remote file system, it requires protection from attacks where a Windows computer might be tricked into contacting a malicious server running inside a trusted network or to a remote server outside the network perimeter. Firewall best practices and configurations can enhance security preventing malicious traffic from leaving the computer or its network.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-0e0a764 elementor-blockquote--skin-border elementor-blockquote--button-color-official elementor-widget elementor-widget-blockquote\" data-id=\"0e0a764\" data-element_type=\"widget\" data-widget_type=\"blockquote.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<blockquote class=\"elementor-blockquote\">\n\t\t\t<p class=\"elementor-blockquote__content\">\n\t\t\t\tImpact of changes\t\t\t<\/p>\n\t\t\t\t\t<\/blockquote>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9bd56e5 elementor-widget elementor-widget-text-editor\" data-id=\"9bd56e5\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Blocking connectivity to SMB may prevent various applications or services from functioning. For a list of Windows and Windows Server applications and services that may stop functioning, review\u00a0<span style=\"color: #ead181;\"><a style=\"color: #ead181;\" href=\"https:\/\/support.microsoft.com\/help\/832017\/service-overview-and-network-port-requirements-for-windows\" target=\"_blank\" rel=\"noopener\">Service overview and network port requirements for Windows<\/a>.<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9d8bde3 elementor-widget elementor-widget-image\" data-id=\"9d8bde3\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"700\" height=\"599\" src=\"https:\/\/cybercrime.rs\/wp-content\/uploads\/2023\/07\/18.png\" class=\"attachment-large size-large\" alt=\"\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-fb2f330 elementor-widget elementor-widget-spacer\" data-id=\"fb2f330\" data-element_type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-8843008 elementor-widget elementor-widget-heading\" data-id=\"8843008\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Weak Passwords<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-4c049cb elementor-widget elementor-widget-spacer\" data-id=\"4c049cb\" data-element_type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-3a34444 elementor-blockquote--skin-border elementor-blockquote--button-color-official elementor-widget elementor-widget-blockquote\" data-id=\"3a34444\" data-element_type=\"widget\" data-widget_type=\"blockquote.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<blockquote class=\"elementor-blockquote\">\n\t\t\t<p class=\"elementor-blockquote__content\">\n\t\t\t\tEnable Azure AD Password Protection\t\t\t<\/p>\n\t\t\t\t\t<\/blockquote>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-c7a726d elementor-widget elementor-widget-text-editor\" data-id=\"c7a726d\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Detects and blocks known weak passwords and their variants and can also block additional weak terms that are specific to your organization.<\/p>\n<p>On-premises deployment of Azure AD Password Protection uses the same global and custom banned password lists that are stored in Azure AD and does the same checks for on-premises password changes as Azure AD does for cloud-based changes.<\/p>\n<p>These checks are performed during password changes and password reset events against on-premises Active Directory Domain Services (AD DS) domain controllers.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-f10cb49 elementor-widget elementor-widget-image\" data-id=\"f10cb49\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"700\" height=\"581\" src=\"https:\/\/cybercrime.rs\/wp-content\/uploads\/2023\/07\/19.png\" class=\"attachment-large size-large\" alt=\"\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-89396e9 elementor-widget elementor-widget-spacer\" data-id=\"89396e9\" data-element_type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-c407fdc elementor-widget elementor-widget-heading\" data-id=\"c407fdc\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Password Leak<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-b86c129 elementor-widget elementor-widget-spacer\" data-id=\"b86c129\" data-element_type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-1675fc3 elementor-blockquote--skin-border elementor-blockquote--button-color-official elementor-widget elementor-widget-blockquote\" data-id=\"1675fc3\" data-element_type=\"widget\" data-widget_type=\"blockquote.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<blockquote class=\"elementor-blockquote\">\n\t\t\t<p class=\"elementor-blockquote__content\">\n\t\t\t\tAzure Identity Protection\t\t\t<\/p>\n\t\t\t\t\t<\/blockquote>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-70282ab elementor-widget elementor-widget-text-editor\" data-id=\"70282ab\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Azure AD works by calculating a user risk level for each user.<\/p>\n<p>The risks identified by Azure AD Identity Protection are:<\/p>\n<ul>\n<li>Leaked credentials<\/li>\n<li>Impossible travel to atypical locations<\/li>\n<li>Sign-ins from infected devices<\/li>\n<li>Sign-ins from anonymous IP addresses<\/li>\n<li>Sign-ins from IP addresses with suspicious activity<\/li>\n<li>Signs in from unfamiliar locations<\/li>\n<\/ul>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-6f68b1f elementor-widget elementor-widget-image\" data-id=\"6f68b1f\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"700\" height=\"581\" src=\"https:\/\/cybercrime.rs\/wp-content\/uploads\/2023\/07\/20.png\" class=\"attachment-large size-large\" alt=\"\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ce34074 elementor-widget elementor-widget-text-editor\" data-id=\"ce34074\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Companies must guarantee that digital evidence they provide in response to legal requests demonstrates a valid\u00a0Chain of Custody\u00a0(CoC) throughout the evidence acquisition, preservation, and access process. To ensure a valid CoC, digital evidence storage must demonstrate adequate access control, data protection and integrity, monitoring and alerting, and logging and auditing.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ba57d7e elementor-widget elementor-widget-spacer\" data-id=\"ba57d7e\" data-element_type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t\t\t<\/div>","protected":false},"excerpt":{"rendered":"<p>How to apply the principles and methods of digital forensics within the cloud environment to investigate a security incident?<\/p>","protected":false},"author":1,"featured_media":9976,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"site-sidebar-layout":"default","site-content-layout":"default","ast-global-header-display":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","footnotes":""},"categories":[34,33,30],"tags":[],"class_list":["post-16517","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-digitalforensics","category-digitalevidence","category-cybersecurity"],"acf":[],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/cybercrime.rs\/en\/wp-json\/wp\/v2\/posts\/16517","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cybercrime.rs\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybercrime.rs\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cybercrime.rs\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cybercrime.rs\/en\/wp-json\/wp\/v2\/comments?post=16517"}],"version-history":[{"count":23,"href":"https:\/\/cybercrime.rs\/en\/wp-json\/wp\/v2\/posts\/16517\/revisions"}],"predecessor-version":[{"id":16633,"href":"https:\/\/cybercrime.rs\/en\/wp-json\/wp\/v2\/posts\/16517\/revisions\/16633"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybercrime.rs\/en\/wp-json\/wp\/v2\/media\/9976"}],"wp:attachment":[{"href":"https:\/\/cybercrime.rs\/en\/wp-json\/wp\/v2\/media?parent=16517"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybercrime.rs\/en\/wp-json\/wp\/v2\/categories?post=16517"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybercrime.rs\/en\/wp-json\/wp\/v2\/tags?post=16517"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}