> For the complete documentation index, see [llms.txt](https://docs.forestall.io/forestall/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/forestall/edges/azure/az_rdp.md). # AZ\_RDP ## Summary | | | | -------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | | **Forestall ACL Alias** | AZ\_RDP | | **Azure Alias** | Virtual Machine User Login / RDP with Entra ID | | **Affected Object Types** | Windows Virtual Machines | | **Exploitation Certainty** | Certain | | **Azure RBAC Roles** | Virtual Machine User Login (`fb879df8-f326-4884-b1cf-06f3ad86be52`), Virtual Machine Administrator Login (`1c0163c0-47e6-4577-8991-ea5c82e286e4`) | **Custom Role Data Actions:** * `Microsoft.Compute/virtualMachines/login/action` * `Microsoft.Compute/virtualMachines/loginAsAdmin/action` **Filter:** Windows VMs with the `AADLoginForWindows` extension and a system-assigned managed identity ## Description `AZ_RDP` represents the ability to **RDP into Windows Azure VMs using Microsoft Entra ID credentials**. This is a data-plane permission that enables interactive desktop access without requiring local VM credentials. Prerequisites for this edge: * The VM must have the **AADLoginForWindows** extension installed. * The VM must have a **system-assigned managed identity** enabled. * The principal must have **Virtual Machine User Login** (standard user) or **Virtual Machine Administrator Login** (local admin) role. | Role | Access Level | | ----------------------------------- | -------------------------- | | Virtual Machine User Login | Remote Desktop Users group | | Virtual Machine Administrator Login | Local Administrators group | This edge is distinct from: * **AZ\_EXECUTE\_COMMAND** - Uses RunCommand API, no interactive session. * **AZ\_VM\_ADMIN\_LOGIN** - Broader scope including SSH to Linux. ## Identification ### PowerShell (Az Module) ```powershell Connect-AzAccount # List Virtual Machine User Login assignments Get-AzRoleAssignment -RoleDefinitionName "Virtual Machine User Login" | Select-Object DisplayName, SignInName, ObjectType, Scope | Format-Table -AutoSize # List Virtual Machine Administrator Login assignments Get-AzRoleAssignment -RoleDefinitionName "Virtual Machine Administrator Login" | Select-Object DisplayName, SignInName, ObjectType, Scope | Format-Table -AutoSize # Find Windows VMs with the Microsoft Entra login extension Get-AzVM | ForEach-Object { $extensions = Get-AzVMExtension -ResourceGroupName $_.ResourceGroupName -VMName $_.Name $aadExt = $extensions | Where-Object { $_.Name -eq "AADLoginForWindows" } if ($aadExt) { [PSCustomObject]@{ VMName = $_.Name ResourceGroup = $_.ResourceGroupName OSType = $_.StorageProfile.OsDisk.OsType AADExtension = $aadExt.Name Identity = $_.Identity.Type } } } | Format-Table -AutoSize ``` ### Azure Portal 1. Open **Azure Portal** -> navigate to the target **Windows VM**. 2. Go to **Extensions + applications** -> verify **AADLoginForWindows** is installed. 3. Go to **Identity** -> verify System assigned identity is enabled. 4. Go to **Access control (IAM)** -> check for login role assignments. ## Exploitation ### RDP with Entra ID Credentials **Method 1: RDP File Configuration (Legacy - Disables NLA)** Standard RDP connection with Entra credentials requires modifying an RDP file. This method disables Network Level Authentication (NLA). 1. Open Remote Desktop Connection (`mstsc.exe`). 2. Enter the VM's IP address or hostname. 3. Click **Show Options** -> **Save As** to save the `.rdp` file locally. 4. Open the saved `.rdp` file in Notepad. 5. Add the following lines at the bottom: ``` enablecredsspsupport:i:0 authentication level:i:2 ``` 6. Save the file and double-click to connect. 7. Enter credentials in format: `.\AzureAD\user@domain.com` > **Note:** The leading `.\` before `AzureAD\` prevents caching issues when the VM auto-locks and you need to sign back in. Without it, you may need to re-enter `AzureAD\` each time. **Method 2: Modern Entra Authentication (Keeps NLA Enabled)** For Windows 10 1809+ and Azure VMs, use modern Entra authentication which maintains NLA security: 1. Save an RDP file as described above. 2. Add the following lines instead: ``` enablerdsaadauth:i:1 targetisaadjoined:i:1 ``` 3. **Important:** You must connect using the VM's **hostname** (not IP address). The hostname must: * Match the computer name registered in Entra ID. * Be resolvable via DNS or local hosts file. 4. Connect using your UPN: `user@domain.com` Alternatively, in `mstsc.exe`: 1. Click **Show Options** -> **Advanced** tab. 2. Check **Use a web account to sign in to the remote computer**. This method triggers a modern authentication prompt supporting MFA and Conditional Access policies. ![Configure an RDP file in VS Code](https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-d5c3352e407d110c734b4146f71347428c337662%2Fazure-az_rdp-rdp-file-vscode.png?alt=media) ![RDP login using mstsc](https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-cf2f6e159b3db7d42de36e26059125ad6e3f7883%2Fazure-az_rdp-rdp-login-using-mstsc.png?alt=media) ### Post-Exploitation - Standard User With Virtual Machine User Login (Remote Desktop Users): ```powershell # Access managed identity token $response = Invoke-RestMethod -Uri "http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/" -Headers @{Metadata="true"} $response.access_token ``` ![Access managed identity token powershell](https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-75a85d1226a343922910928589bee02fb55bebbe%2Fazure-az_rdp-post-exploitation-get-managedidentity-token-powershell.png?alt=media) ### Post-Exploitation - Administrator With Virtual Machine Administrator Login (Local Administrators): ```powershell # Steal managed identity token $response = Invoke-RestMethod -Uri "http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/" -Headers @{Metadata="true"} $response.access_token ``` ![Access managed identity token powershell](https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-75a85d1226a343922910928589bee02fb55bebbe%2Fazure-az_rdp-post-exploitation-get-managedidentity-token-powershell.png?alt=media) ## Mitigation 1. **Minimize login role assignments** * Remove Virtual Machine User/Administrator Login from identities that dont need interactive access. * Use **AZ\_EXECUTE\_COMMAND** (RunCommand) for automated tasks instead. 2. **Use Virtual Machine User Login instead of Administrator Login** * Grant standard user access unless admin is specifically required. 3. **Restrict Microsoft Entra login extension deployment** * Only deploy the extension on VMs that require Entra-based authentication. * Use Azure Policy to audit extension deployments. 4. **Network security** * Restrict RDP (port 3389) access via NSGs. * Use Azure Bastion for secure access without public endpoints. * Enable Just-in-Time VM access. 5. **Enable endpoint protection** * Deploy Microsoft Defender for Endpoint. * Enable Credential Guard on supported Windows versions. ## Detection Use the Azure Portal and Microsoft Entra admin center: 1. In **Azure Portal**, open the target **Windows VM**. 2. Open **Activity log** and filter **Operation** for `login` or `loginAsAdmin`. 3. Review `Microsoft.Compute/virtualMachines/login/action` and `Microsoft.Compute/virtualMachines/loginAsAdmin/action` events. 4. Open **Microsoft Entra ID** -> **Sign-in logs** and filter **Application** for **Azure Windows VM Sign-In**. 5. Review **User**, **IP address**, **Location**, **Date**, and **Status** for unexpected RDP logins. 6. On the VM blade, review **Access control (IAM)** for **Virtual Machine User Login** and **Virtual Machine Administrator Login** assignments. 7. Open **Extensions + applications** and confirm whether **AADLoginForWindows** is present. ## References * * * * * *