Azure Security Architect: 2026-09-30

1. Beyond source code: A path to the keys to the kingdom

   Microsoft Defender Experts Cybersecurity Incident Response, 2026-09-29. Read, 6 min.

   Microsoft's Detection and Response Team (DART) describes an intrusion in which Storm-3068 took over a user account through a self-service password reset, registered its own authentication methods, and used legitimate identity and cloud services rather than malware or software exploits to reach Azure DevOps, pipelines, and Kubernetes resources. The actor created a pipeline to harvest Kubernetes credentials and modified pipeline scripts to install the Atera remote management agent and download the Chisel tunneling utility.

   Why it matters for this role: Limit which privileged accounts in the estate can use self-service password reset, since one reset let Storm-3068 register its own authentication methods and move into Azure DevOps.

Azure Security Architect