{"product_id":"certified-azure-purple-teamer","title":"Certified Azure Purple Teamer","description":"\u003cp\u003e\u003cstrong\u003eName of Training:\u003c\/strong\u003e Certified Azure Purple Teamer\u003cbr\u003e\u003cstrong\u003eTrainer:\u003c\/strong\u003e Hackers Academy\u003cbr\u003e\u003cstrong\u003eDates:\u003c\/strong\u003e November 08-10, 2026\u003cbr\u003e\u003cstrong\u003eTime:\u003c\/strong\u003e 9:00 am - 5:00 pm\u003cbr\u003e\u003cstrong\u003eVenue:\u003c\/strong\u003e Exhibition World Bahrain\u003cbr\u003e\u003cstrong\u003eCost:\u003c\/strong\u003e 1200 BHD\u003c\/p\u003e\n\u003ch2\u003e1. Short Summary\u003c\/h2\u003e\n\u003cp\u003eLearn exactly what groups like LAPSUS, Star Blizzard, Storm-2373, Storm-0485, Storm-0501 and many others do and how you can lock down your Azure tenant to defend against them.\u003c\/p\u003e\n\u003ch2\u003e2. Course Description\u003c\/h2\u003e\n\u003cp\u003eFollow along with famous APTs, understand and replicate their TTPs in the live lab, then work hard on fortifying your Azure castle.\u003c\/p\u003e\n\u003cp\u003eDesigned for cloud engineers, administrators, architects, penetration testers and defenders, this training gives you a solid understanding of the day-to-day operations and resulting misconfigurations, different attacks path and multiple ways for initial access, persistence and privilege escalation. Followed by how you can enforce, audit, monitor and secure your Azure services.\u003c\/p\u003e\n\u003cp\u003eWith a great balance between practice and theory, you will quickly get your hands dirty with Azure services and multiple attack tools and techniques.\u003c\/p\u003e\n\u003cp\u003eWith 25 Red Labs and 22 Blue Lab, some of the topics covered will include:\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eSetting up for successful defense\u003c\/li\u003e\n\u003cli\u003eFoundations of Azure security: logs, network security, defender, etc.\u003c\/li\u003e\n\u003cli\u003eRecon and enumeration\u003c\/li\u003e\n\u003cli\u003e5 different ways to compromise identities\u003c\/li\u003e\n\u003cli\u003eIdentity protection and defense\u003c\/li\u003e\n\u003cli\u003eFinding gaps in Conditional Access\u003c\/li\u003e\n\u003cli\u003eFull Storage attack chain including persistence, C2 and exfil\u003c\/li\u003e\n\u003cli\u003eAbusing and securing Automation Accounts\u003c\/li\u003e\n\u003cli\u003eNetwork Services to lock down your resources\u003c\/li\u003e\n\u003cli\u003eKey Vaults pillaging, persistence and defense\u003c\/li\u003e\n\u003cli\u003eLocking down your secrets\u003c\/li\u003e\n\u003cli\u003eAzure Container Registries misconfigurations and security\u003c\/li\u003e\n\u003cli\u003eAbusing VMs for tokens, secrets and shell\u003c\/li\u003e\n\u003cli\u003eMonitoring and detecting VM abuse\u003c\/li\u003e\n\u003cli\u003eAnd a lot more!\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch2\u003e3. Course Outline\u003c\/h2\u003e\n\u003ch3\u003eDay 1\u003c\/h3\u003e\n\u003ch4\u003e3.1 Introduction \u0026amp; Lab Setup\u003c\/h4\u003e\n\u003cp\u003e\u003cstrong\u003e3.1.1\u003c\/strong\u003e Introduction to Microsoft Azure and some of the most used services\u003cbr\u003e\u003cstrong\u003e3.1.2\u003c\/strong\u003e Important Azure concepts and terminology: tenant, subscription, resource groups, resource, etc.\u003c\/p\u003e\n\u003ch4\u003e3.2 Defender Essentials\u003c\/h4\u003e\n\u003cp\u003e\u003cstrong\u003e3.2.1\u003c\/strong\u003e Control and data planes\u003cbr\u003e\u003cstrong\u003e3.2.2\u003c\/strong\u003e Roles (IAM and Entra roles)\u003cbr\u003e\u003cstrong\u003e3.2.3\u003c\/strong\u003e Different types of logs in Azure\u003cbr\u003e\u003cstrong\u003e3.2.4\u003c\/strong\u003e Where to store logs\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eBlue Lab: Create Log Analytics\u003c\/li\u003e\n\u003cli\u003eBlue Lab: Analyze Entra ID Activity Logs\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch4\u003e3.3 Network Security\u003c\/h4\u003e\n\u003cp\u003e\u003cstrong\u003e3.3.1\u003c\/strong\u003e Virtual networks\u003cbr\u003e\u003cstrong\u003e3.3.2\u003c\/strong\u003e VNet Service Endpoints\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eBlue Lab (optional): Create a VNet \u0026amp; Service Endpoint\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003e\u003cstrong\u003e3.3.3\u003c\/strong\u003e Private Endpoints\u003c\/p\u003e\n\u003ch4\u003e3.4 Recon\u003c\/h4\u003e\n\u003cp\u003e\u003cstrong\u003e3.4.1\u003c\/strong\u003e Tenant availability and gather tenant information\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eRed Lab: Validating tenant availability\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003e\u003cstrong\u003e3.4.2\u003c\/strong\u003e Azure subdomains recon as outsider\u003cbr\u003e\u003cstrong\u003e3.4.3\u003c\/strong\u003e Identifying Azure services in use\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eRed Lab: Enumerating subdomains\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003e\u003cstrong\u003e3.4.4\u003c\/strong\u003e User enumeration in Azure\u003cbr\u003e\u003cstrong\u003e3.4.5\u003c\/strong\u003e Understanding error codes\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eRed Lab: Enumerating usernames\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch4\u003e3.5 Identity Attacks for Initial Access\u003c\/h4\u003e\n\u003cp\u003e\u003cstrong\u003e3.5.1\u003c\/strong\u003e Entra Connect – Case Study: Mercury \u0026amp; Dev\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eRed Lab: Retrieving passwords for on-prem and on-cloud users\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003e\u003cstrong\u003e3.5.2\u003c\/strong\u003e Obtaining Valid Credentials – Case Study: LAPSUS$\u003cbr\u003e\u003cstrong\u003e3.5.3\u003c\/strong\u003e Credential Stuffing – Case Study: Multiple APTs\u003cbr\u003e\u003cstrong\u003e3.5.4\u003c\/strong\u003e Password Spraying – Case Study: Multiple APTs\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eRed Lab: Password spraying\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003e\u003cstrong\u003e3.5.5\u003c\/strong\u003e Consent Phishing – Case Study: Multiple APTs\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eRed Lab: Consent grant\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003e\u003cstrong\u003e3.5.6\u003c\/strong\u003e Device Code Phishing – Case Study: Storm-2373\u003cbr\u003e\u003cstrong\u003e3.5.7\u003c\/strong\u003e Adversary-in-The-Middle – Case Study: Star Blizzard, Storm-0485\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eRed Lab: AiTM\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003e\u003cstrong\u003e3.5.8\u003c\/strong\u003e NEW: Device join phishing\u003cbr\u003e\u003cstrong\u003e3.5.9\u003c\/strong\u003e NEW: Teams phishing – Case Study: Storm-1674\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eRed Lab: Teams calls phishing\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003e\u003cstrong\u003e3.5.10\u003c\/strong\u003e NEW: Using AI for phishing lures\u003c\/p\u003e\n\u003ch4\u003e3.6 Identity Attacks Defense \u0026amp; Detection\u003c\/h4\u003e\n\u003cp\u003e\u003cstrong\u003e3.6.1\u003c\/strong\u003e Password spraying\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eDefenses, playbooks, triggers and investigation\u003c\/li\u003e\n\u003cli\u003eBlue Lab: Investigate password spraying\u003c\/li\u003e\n\u003cli\u003eBlue Lab: Investigate password spraying with IP rotation\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003e\u003cstrong\u003e3.6.2\u003c\/strong\u003e Consent Phishing\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eDefenses, playbooks, triggers and investigations\u003c\/li\u003e\n\u003cli\u003eAuditing app permissions\u003c\/li\u003e\n\u003cli\u003eUnderstanding consent types\u003c\/li\u003e\n\u003cli\u003eBlue Lab: Investigate app consent\u003c\/li\u003e\n\u003cli\u003eBlue Lab: Create and review app consent workbook\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003e\u003cstrong\u003e3.6.3\u003c\/strong\u003e AiTM\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eDefense best practices\u003c\/li\u003e\n\u003cli\u003eUnderstanding different types of tokens\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003e\u003cstrong\u003e3.6.4\u003c\/strong\u003e Device Code Phishing\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eBest practices for protection\u003c\/li\u003e\n\u003cli\u003eConditional Access Policies\u003c\/li\u003e\n\u003cli\u003eInvestigating device code phishing\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003e\u003cstrong\u003e3.6.5\u003c\/strong\u003e General Identity Security\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eSecure Score for Identity\u003c\/li\u003e\n\u003cli\u003eSecure Score top actions (password protection, SSPR, MFA, CAPs, PIM etc.)\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch3\u003eDay 2\u003c\/h3\u003e\n\u003ch4\u003e3.7 Conditional Access Policies\u003c\/h4\u003e\n\u003cp\u003e\u003cstrong\u003e3.7.1\u003c\/strong\u003e Understanding CAPs\u003cbr\u003e\u003cstrong\u003e3.7.2\u003c\/strong\u003e What CAPs can and cannot do – Case Study: APT29\u003cbr\u003e\u003cstrong\u003e3.7.3\u003c\/strong\u003e Understanding CAP gaps\u003cbr\u003e\u003cstrong\u003e3.7.4\u003c\/strong\u003e CAP bypass strategies: membership, location, device, application …\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eRed Lab: Bypass CAP\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003e\u003cstrong\u003e3.7.5\u003c\/strong\u003e Token types and FOCI\u003cbr\u003e\u003cstrong\u003e3.7.6\u003c\/strong\u003e Bypassing CAP with stolen tokens\u003c\/p\u003e\n\u003ch4\u003e3.8 Conditional Access Policies – Closing The Gaps\u003c\/h4\u003e\n\u003cp\u003e\u003cstrong\u003e3.8.1\u003c\/strong\u003e Recommendations and best practices when planning CAPs\u003cbr\u003e\u003cstrong\u003e3.8.2\u003c\/strong\u003e What-if tool\u003cbr\u003e\u003cstrong\u003e3.8.3\u003c\/strong\u003e Analyzing insights and reporting and understanding CAP impacts\u003cbr\u003e\u003cstrong\u003e3.8.4\u003c\/strong\u003e Using Microsoft templates\u003cbr\u003e\u003cstrong\u003e3.8.5\u003c\/strong\u003e Gap Analyzer\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eBlue Lab: CAP insights and reporting\u003c\/li\u003e\n\u003cli\u003eBlue Lab: CAP Gap Analyzer\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch4\u003e3.9 Entra ID Roles \u0026amp; External Collaboration\u003c\/h4\u003e\n\u003cp\u003e\u003cstrong\u003e3.9.1\u003c\/strong\u003e Entra ID resources\u003cbr\u003e\u003cstrong\u003e3.9.2\u003c\/strong\u003e Deep dive in Azure Entra ID roles and permissions\u003cbr\u003e\u003cstrong\u003e3.9.3\u003c\/strong\u003e Understanding users, groups and service principals\u003cbr\u003e\u003cstrong\u003e3.9.4\u003c\/strong\u003e Dynamic group membership\u003cbr\u003e\u003cstrong\u003e3.9.5\u003c\/strong\u003e Guest invites\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eRed Lab: Abusing guest access for persistence\u003c\/li\u003e\n\u003cli\u003eRed Lab: Abusing dynamic groups for privilege escalation\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch4\u003e3.10 External Collaboration Security Strategies\u003c\/h4\u003e\n\u003cp\u003e\u003cstrong\u003e3.10.1\u003c\/strong\u003e Entra ID risky default settings \u0026amp; their implications\u003cbr\u003e\u003cstrong\u003e3.10.2\u003c\/strong\u003e Entitlement Management\u003cbr\u003e\u003cstrong\u003e3.10.3\u003c\/strong\u003e Access Packages\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eBlue Lab: External Collaboration Identity Governance\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch4\u003e3.11 Entra ID App Registrations\u003c\/h4\u003e\n\u003cp\u003e\u003cstrong\u003e3.11.1\u003c\/strong\u003e Understanding app registration\u003cbr\u003e\u003cstrong\u003e3.11.2\u003c\/strong\u003e What are service principals?\u003cbr\u003e\u003cstrong\u003e3.11.3\u003c\/strong\u003e Entra ID risky default settings \u0026amp; their implications\u003cbr\u003e\u003cstrong\u003e3.11.4\u003c\/strong\u003e App secrets and certificates\u003cbr\u003e\u003cstrong\u003e3.11.5\u003c\/strong\u003e Case Study: Nobelium APT\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eRed Lab: App registrations for persistence and privilege escalation\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch4\u003e3.12 Entra ID App Registrations Security Strategies\u003c\/h4\u003e\n\u003cp\u003e\u003cstrong\u003e3.12.1\u003c\/strong\u003e Understanding app API permissions\u003cbr\u003e\u003cstrong\u003e3.12.2\u003c\/strong\u003e Delegated vs. App permissions\u003cbr\u003e\u003cstrong\u003e3.12.3\u003c\/strong\u003e Best practices when using service principals\u003cbr\u003e\u003cstrong\u003e3.12.4\u003c\/strong\u003e Reviewing service principal permission assignments\u003cbr\u003e\u003cstrong\u003e3.12.5\u003c\/strong\u003e Investigating service principal logins\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eBlue Lab: investigate service principal logins\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003e\u003cstrong\u003e3.12.6\u003c\/strong\u003e PIM notifications on permissions changes\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eBlue Lab: review SP role assignment changes\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch4\u003e3.13 Managed Identities\u003c\/h4\u003e\n\u003cp\u003e\u003cstrong\u003e3.13.1\u003c\/strong\u003e Understanding managed IDs\u003cbr\u003e\u003cstrong\u003e3.13.2\u003c\/strong\u003e Where can managed ID be used\u003cbr\u003e\u003cstrong\u003e3.13.3\u003c\/strong\u003e Types of managed IDs\u003cbr\u003e\u003cstrong\u003e3.13.4\u003c\/strong\u003e Managed ID tokens\u003cbr\u003e\u003cstrong\u003e3.13.5\u003c\/strong\u003e IMDS with virtual machines\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eRed Lab: Retrieving managed ID token from IMDS\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch4\u003e3.14 Managed Identities Security Strategies\u003c\/h4\u003e\n\u003cp\u003e\u003cstrong\u003e3.14.1\u003c\/strong\u003e Finding and reviewing managed IDs: portal vs. PowerShell vs. Graph Explorer\u003cbr\u003e\u003cstrong\u003e3.14.2\u003c\/strong\u003e Reviewing role assignments\u003c\/p\u003e\n\u003ch4\u003e3.15 Azure IAM (RBAC)\u003c\/h4\u003e\n\u003cp\u003e\u003cstrong\u003e3.15.1\u003c\/strong\u003e IAM vs. Entra roles\u003cbr\u003e\u003cstrong\u003e3.15.2\u003c\/strong\u003e Primary resource roles\u003cbr\u003e\u003cstrong\u003e3.15.3\u003c\/strong\u003e Separation of IAM and Entra roles\u003cbr\u003e\u003cstrong\u003e3.15.4\u003c\/strong\u003e Global admin elevation to RBAC – Case Study: Dev-1084 APT\u003c\/p\u003e\n\u003ch4\u003e3.16 Storage Attack Chain\u003c\/h4\u003e\n\u003cp\u003e\u003cstrong\u003e3.16.1\u003c\/strong\u003e Storage types\u003cbr\u003e\u003cstrong\u003e3.16.2\u003c\/strong\u003e Storage accounts\u003cbr\u003e\u003cstrong\u003e3.16.3\u003c\/strong\u003e Storage endpoints\u003cbr\u003e\u003cstrong\u003e3.16.4\u003c\/strong\u003e Storage Access Levels\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eRed Lab: Enumerate and access public storage\u003c\/li\u003e\n\u003cli\u003eRed Lab: Storage enumeration with custom wordlist\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003e\u003cstrong\u003e3.16.5\u003c\/strong\u003e 3 Types of Shared Access Signatures\u003cbr\u003e\u003cstrong\u003e3.16.6\u003c\/strong\u003e Accessing storage with Entra ID credentials\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eRed Lab: Storage access with credentials\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003e\u003cstrong\u003e3.16.7\u003c\/strong\u003e Storage Account Access – Case Study: Storm-0501\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eSAS\u003c\/li\u003e\n\u003cli\u003eEntra ID authorization\u003c\/li\u003e\n\u003cli\u003eShared Keys\u003c\/li\u003e\n\u003cli\u003eRed Lab: Access account with shared key\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003e\u003cstrong\u003e3.16.8\u003c\/strong\u003e NEW: Storage Attack Chain – Case Study: Multiple APTs\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eRecon\u003c\/li\u003e\n\u003cli\u003eResource development: Storage for phishing infrastructure\u003c\/li\u003e\n\u003cli\u003eInitial access\u003c\/li\u003e\n\u003cli\u003ePersistence: IAM manipulation, SAS generation\u003c\/li\u003e\n\u003cli\u003eDefense Evasion: log tampering and deletion\u003c\/li\u003e\n\u003cli\u003eCredential Access: token and key extraction, cloud shell\u003c\/li\u003e\n\u003cli\u003eDiscovery: querying for valuable information\u003c\/li\u003e\n\u003cli\u003eLateral Movement: targeting functions or automation that uses storage\u003c\/li\u003e\n\u003cli\u003eCollection: copying and moving data to storage, pre-exfil\u003c\/li\u003e\n\u003cli\u003eExfiltration: exfil using web containers, automation accounts, etc.\u003c\/li\u003e\n\u003cli\u003eC2 using blob storage\u003c\/li\u003e\n\u003cli\u003eImpact: mass deletion, overwriting or encryption\u003c\/li\u003e\n\u003cli\u003eRed Lab: Lateral movement using automation accounts and storage\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch3\u003eDay 3\u003c\/h3\u003e\n\u003ch4\u003e3.17 Storage Security\u003c\/h4\u003e\n\u003cp\u003e\u003cstrong\u003e3.17.1\u003c\/strong\u003e Disabling anonymous access – planning phase\u003cbr\u003e\u003cstrong\u003e3.17.2\u003c\/strong\u003e D.R.A.G before disabling anonymous access\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eBlue Lab: Investigate storage logs\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003e\u003cstrong\u003e3.17.3\u003c\/strong\u003e SAS tracking challenges\u003cbr\u003e\u003cstrong\u003e3.17.4\u003c\/strong\u003e SAS best practices: disallow, least privilege, revocation plan\u003cbr\u003e\u003cstrong\u003e3.17.5\u003c\/strong\u003e SAS policies\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eBlue Lab: Find accounts with SAS\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003e\u003cstrong\u003e3.17.6\u003c\/strong\u003e Network security: firewall, private endpoint, secure transfer\u003cbr\u003e\u003cstrong\u003e3.17.7\u003c\/strong\u003e Logging \u0026amp; monitoring\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eBlue Lab: Monitor for storage authorization\u003c\/li\u003e\n\u003cli\u003eBlue Lab: Storage Diagnostic Settings\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003e\u003cstrong\u003e3.18 Automation Accounts PrivEsc and Persistence\u003c\/strong\u003e\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003e3.18.1\u003c\/strong\u003e Understanding Automation Accounts\u003cbr\u003e\u003cstrong\u003e3.18.2\u003c\/strong\u003e Run As vs. Managed Identity\u003cbr\u003e\u003cstrong\u003e3.18.3\u003c\/strong\u003e Finding secrets in variables\u003cbr\u003e\u003cstrong\u003e3.18.4\u003c\/strong\u003e Runbooks and runbooks’ modules\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eRed Lab: Abusing runbook for privilege escalation\u003c\/li\u003e\n\u003cli\u003eNEW Red Lab: Abusing runbook for reverse shell\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003e\u003cstrong\u003e3.18.5\u003c\/strong\u003e Webhooks\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eRed Lab: Creating webhook for persistence\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch4\u003e3.19 Automation Accounts Security\u003c\/h4\u003e\n\u003cp\u003e\u003cstrong\u003e3.19.1\u003c\/strong\u003e Job output precautions\u003cbr\u003e\u003cstrong\u003e3.19.2\u003c\/strong\u003e Precautions with variables\u003cbr\u003e\u003cstrong\u003e3.19.3\u003c\/strong\u003e Using service\/private endpoints\u003cbr\u003e\u003cstrong\u003e3.19.4\u003c\/strong\u003e Using managed IDs\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eNEW Blue Lab: Encrypted variables in Automation Accounts\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch4\u003e3.20 Virtual Machines\u003c\/h4\u003e\n\u003cp\u003e\u003cstrong\u003e3.20.1\u003c\/strong\u003e VM extensions\u003cbr\u003e\u003cstrong\u003e3.20.2\u003c\/strong\u003e VM disk snapshots Encrypted vs. Unencrypted\u003cbr\u003e\u003cstrong\u003e3.20.3\u003c\/strong\u003e VM run command\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eRed Lab: Run command for privilege escalation\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003e\u003cstrong\u003e3.20.4\u003c\/strong\u003e NEW: NSGs\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eRed Lab: Manipulating NSGs to allow remote access\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003e\u003cstrong\u003e3.20.5\u003c\/strong\u003e NEW: Quota manipulation for attack infrastructure – Case Study: Unknown APT\u003c\/p\u003e\n\u003ch4\u003e3.21 Virtual Machines Security Strategies\u003c\/h4\u003e\n\u003cp\u003e\u003cstrong\u003e3.21.1\u003c\/strong\u003e NSG vs. Firewall vs. WAF\u003cbr\u003e\u003cstrong\u003e3.21.2\u003c\/strong\u003e Restricting management ports\u003cbr\u003e\u003cstrong\u003e3.21.3\u003c\/strong\u003e Understanding Bastion Hosts\u003cbr\u003e\u003cstrong\u003e3.21.4\u003c\/strong\u003e PIM access\u003cbr\u003e\u003cstrong\u003e3.21.5\u003c\/strong\u003e Azure Update Manager\u003cbr\u003e\u003cstrong\u003e3.21.6\u003c\/strong\u003e Disk encryption\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eBlue Lab: Retrieving hashes from snapshots – encrypted vs. unencrypted\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003e\u003cstrong\u003e3.21.7\u003c\/strong\u003e NEW: Quota alerts expected and unexpected quota consumption\u003c\/p\u003e\n\u003ch4\u003e3.22 Key Vaults\u003c\/h4\u003e\n\u003cp\u003e\u003cstrong\u003e3.22.1\u003c\/strong\u003e Understanding key vaults\u003cbr\u003e\u003cstrong\u003e3.22.2\u003c\/strong\u003e Key vault access policies\u003cbr\u003e\u003cstrong\u003e3.22.3\u003c\/strong\u003e Key vault IAM\u003cbr\u003e\u003cstrong\u003e3.22.4\u003c\/strong\u003e Managed IDs and Key Vaults\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eRed Lab: Retrieving secrets from key vaults\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003e\u003cstrong\u003e3.22.5\u003c\/strong\u003e Key vault tampering for persistence – Case Study: Unknown APT\u003c\/p\u003e\n\u003ch4\u003e3.23 Key Vaults Security Strategies\u003c\/h4\u003e\n\u003cp\u003e\u003cstrong\u003e3.23.1\u003c\/strong\u003e Key vault RBAC vs. Access Policies\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eBlue Lab: Different built-in roles for different jobs\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003e\u003cstrong\u003e3.23.2\u003c\/strong\u003e Firewalling key vaults\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eBlue Lab: Firewall your key vault\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003e\u003cstrong\u003e3.23.3\u003c\/strong\u003e Key vaults on private endpoints\u003cbr\u003e\u003cstrong\u003e3.23.4\u003c\/strong\u003e CAPs for key vaults\u003cbr\u003e\u003cstrong\u003e3.23.5\u003c\/strong\u003e Purge protection\u003cbr\u003e\u003cstrong\u003e3.23.6\u003c\/strong\u003e Monitoring key vaults\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eWho’s listing and retrieving secrets\u003c\/li\u003e\n\u003cli\u003eWho’s accessing the key vaults\u003c\/li\u003e\n\u003cli\u003eBlue Lab: Queries to monitor retrieving secrets and accessing key vaults\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch4\u003e3.24 Azure Container Registries (ACRs)\u003c\/h4\u003e\n\u003cp\u003e\u003cstrong\u003e3.24.1\u003c\/strong\u003e Container lifecycle\u003cbr\u003e\u003cstrong\u003e3.24.2\u003c\/strong\u003e ACR anonymous access\u003cbr\u003e\u003cstrong\u003e3.24.3\u003c\/strong\u003e ACR reader access\u003cbr\u003e\u003cstrong\u003e3.24.4\u003c\/strong\u003e ACR admin access\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eRed Lab: Pulling and inspecting images for secrets\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch4\u003e3.25 ACR Security Strategies\u003c\/h4\u003e\n\u003cp\u003e\u003cstrong\u003e3.25.1\u003c\/strong\u003e ACR authentication best practices\u003cbr\u003e\u003cstrong\u003e3.25.2\u003c\/strong\u003e Securing ACR pull\u003cbr\u003e\u003cstrong\u003e3.25.3\u003c\/strong\u003e Service endpoints for ACR\u003cbr\u003e\u003cstrong\u003e3.25.4\u003c\/strong\u003e Container image vulnerability management\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eNEW Blue Lab: Restricting network access to ACRs\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch4\u003e3.26 Final Exam\u003c\/h4\u003e\n\u003cul\u003e\n\u003cli\u003eA CTF style mimicking parts of a breach by Storm-0501.\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch2\u003e4. Difficulty Level\u003c\/h2\u003e\n\u003cp\u003e\u003cstrong\u003eBeginner\u003c\/strong\u003e - The student has an interest in the topic presented and general technology knowledge that a power user or undergraduate student may have acquired.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003eIntermediate\u003c\/strong\u003e - The student has education and some experience in the field and familiarity with the topic being presented. The student has foundational knowledge that the course will leverage to provide practical skills on the topic.\u003c\/p\u003e\n\u003ch2\u003e5. Suggested Prerequisites\u003c\/h2\u003e\n\u003cp\u003eStudents are not expected to have knowledge of cloud services. However, it would help to have a basic level understanding of cyber security concepts, networking and operating systems.\u003c\/p\u003e\n\u003ch2\u003e6. What Students Should Bring\u003c\/h2\u003e\n\u003cul\u003e\n\u003cli\u003eStudents should bring a laptop with RDP client.\u003c\/li\u003e\n\u003cli\u003eAll labs are cloud based.\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch2\u003e7. What the Trainer Will Provide\u003c\/h2\u003e\n\u003cul\u003e\n\u003cli\u003eStudents will be provided with all course material. This includes over 300 slides and over 70 pages of lab manuals.\u003c\/li\u003e\n\u003cli\u003eCloud labs will be available for each student for 90 hours usage (within 15 days from the start of the training).\u003c\/li\u003e\n\u003cli\u003eThe instructors will share their own lab guides and scripts so students can replicate the setup in their private labs.\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch2\u003e8. Trainer Bio\u003c\/h2\u003e\n\u003ch3\u003eTim Katsapas\u003c\/h3\u003e\n\u003cp\u003eTim Katsapas is the Founder of Turing Cyber and a senior trainer at Hackers Academy. He is a seasoned security professional with deep expertise in Azure, M365, and hybrid cloud security.\u003c\/p\u003e\n\u003cp\u003eWith a strong background in both cloud and on-premises environments, Tim previously worked at Microsoft as a Premier Field Engineer and Cloud Solution Architect specializing in identity and security. His focus included Active Directory and Entra ID security assessments, helping enterprises maximize the value of Entra ID P2 and Microsoft 365 E5 security features.\u003c\/p\u003e\n\u003cp\u003eAn MCT since 2008, Tim has delivered technical training globally, including at Microsoft and Black Hat Europe and US. He holds numerous certifications, including OSCP and over 30 Microsoft credentials.\u003c\/p\u003e\n\u003ch2\u003e9. Registration Terms and Conditions\u003c\/h2\u003e\n\u003cp\u003e\u003cstrong\u003e9.1\u003c\/strong\u003e Trainings are refundable before September 21, 2026, minus a non-refundable processing fee of 100 BHD.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003e9.2\u003c\/strong\u003e Between September 21, 2026 and October 21, 2026 partial refunds will be granted, equal to 50% of the course fee minus a processing fee of 100 BHD.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003e9.3\u003c\/strong\u003e All trainings are non-refundable after October 21, 2026.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003e9.4\u003c\/strong\u003e Training tickets may be transferred to another student. Please email us at \u003ca href=\"mailto:training@defcon.org\"\u003etraining@defcon.org\u003c\/a\u003e for specifics.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003e9.5\u003c\/strong\u003e If a training does not reach the minimum registration requirement, it may be cancelled. In the event the training you choose is cancelled, you will be provided the option of receiving a full refund or transferring to another training (subject to availability).\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003e9.6\u003c\/strong\u003e Failure to attend the training without prior written notification will be considered a no-show. No refund will be given.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003e9.7\u003c\/strong\u003e DEF CON Training may share student contact information, including names and emails, with the course instructor(s) to facilitate sharing of pre-work and course instructions. Instructors are required to safeguard this information and provide appropriate protection so that it is kept private. Instructors may not use student information outside the delivery of this course without the permission of the student.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003e9.8\u003c\/strong\u003e By purchasing this ticket you agree to abide by the \u003ca href=\"https:\/\/defcon.org\/html\/links\/dc-code-of-conduct.html\"\u003eDEF CON Training Code of Conduct\u003c\/a\u003e and the registration terms and conditions listed above.\u003c\/p\u003e","brand":"DEFCON MIDDLE EAST","offers":[{"title":"Course only","offer_id":49942336372979,"sku":null,"price":1200.0,"currency_code":"BHD","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/0841\/4815\/8707\/files\/default_DCT_photo.webp?v=1786559556","url":"https:\/\/me.shop.defcon.org\/products\/certified-azure-purple-teamer","provider":"DEF CON MIDDLE EAST","version":"1.0","type":"link"}