Azure Secret Hunting: MicroBurst Secrets Hunter and Secrets Stalker

A TrustedSec researcher introduced two tools to speed up secret hunting in an Azure subscriptions and assess access granted by discovered secrets. Both complement data collection through MicroBurst (NetSPI), a tool for enumerating Azure assets using an authenticated account. Subscription-level Reader access is generally recommended to get the most out of MicroBurst.

Microburst Secrets Hunter — the post-collection stage. It operates entirely offline on data collected during MicroBurst enumeration and does not access the cloud. Capabilities: • extracts secrets from Logic Apps, virtual machine extensions, automation accounts, and Azure resource deployment logs; • can be run as a standalone script or imported as a module to use its cmdlet; • redacts findings by default for reporting purposes (full secret values can be displayed using a separate switch).

Secrets Stalker —assesses what access a compromised client secret grants, including access to Azure Resource Manager (ARM) or Microsoft Graph. Unlike noisy and time-consuming enumeration with AzureHound, this is a targeted check. What it shows: • whether the secret is valid and its expiration date; • Microsoft Graph permissions; • potential privilege escalation paths (for example, write access to directory objects such as users and groups).

The author highlights a separate attack path: if an application can write to directory objects (users and groups), an assigned group with owner permissions can potentially be used to take over the subscription. Subscription takeover is considered more valuable than Global Administrator privileges: subscriptions may be less monitored, making privilege escalation more likely to go undetected.

Article: https://trustedsec.com/blog/the-art-of-hunting-azure-cloud-secrets Tool (Microburst Secrets Hunter): https://github.com/rootsecdev/MicroburstSecretsHunter Tool (Secrets Stalker): https://github.com/rootsecdev/SecretsStalker