Lesson 26 — Microsoft Defender for App Service
Azure App Service makes it easy to publish web applications and APIs without managing the underlying operating system. That removes infrastructure work, but it does not remove application risk.
Microsoft Defender for App Service is natively integrated with Azure App Service and uses cloud-scale platform telemetry, application traffic and threat intelligence to identify attacks targeting hosted applications.
This lesson explains how Defender for App Service detects suspicious requests and post-exploitation activity, how security recommendations reduce exposure, and how Agent Foskett investigates a web application that stayed online while an attacker executed code behind it.
What you will learn
This lesson follows App Service protection from configuration and deployment through attack detection and investigation.
How Microsoft Defender for App Service works
↓
Application traffic passes through Azure platform gateways
↓
Defender analyses platform telemetry, behaviour and threat intelligence
↓
Suspicious requests or post-exploitation activity are detected
↓
A Defender for Cloud security alert is generated
↓
Agent Foskett reviews the app, request, process, files, identity and deployment history
↓
The exploit path and attacker actions are confirmed
↓
The app is contained and credentials are rotated
↓
A patched build is deployed through a trusted pipeline
↓
Monitoring confirms the attack path is closed
App Service protection layers
| Layer | Purpose | Example control |
|---|---|---|
| Platform protection | Azure-managed App Service infrastructure. | Managed operating system and platform maintenance. |
| Posture management | Reduce unsafe application configuration. | HTTPS, identity and network recommendations. |
| Edge protection | Filter malicious requests before the app. | WAF and access restrictions. |
| Threat detection | Detect attacks and suspicious behaviour. | Defender for App Service alerts. |
| Application security | Prevent vulnerabilities in code and dependencies. | Secure development and patching. |
| Response | Contain and recover from compromise. | Credential rotation and trusted redeployment. |
Learning objectives
- Explain Defender for App Service.
- Understand its native integration.
- Recognise common application attacks.
- Review App Service security recommendations.
- Investigate suspicious processes and requests.
- Protect identities, secrets and deployments.
- Contain and safely redeploy a compromised app.
What is Defender for App Service?
Microsoft Defender for App Service is a Defender for Cloud workload-protection plan for Azure App Service resources. It detects attacks against web applications and APIs using Azure platform telemetry, request patterns and Microsoft threat intelligence.
Native integration
Defender for App Service does not require a separate security agent or manual onboarding inside the application. Protection is integrated into the Azure App Service platform.
Protected workload types
- Azure Web Apps
- API Apps
- App Service hosted application workloads
- Supported App Service plans
Always verify current plan, region and feature support before deployment.
Platform telemetry
Requests to App Service pass through Azure platform gateways. Defender analyses relevant platform signals to identify exploits, malicious sources and abnormal behaviour.
Cloud-scale analytics
Microsoft can compare patterns across a large cloud environment, helping identify attack infrastructure and techniques that may appear ordinary when viewed in isolation.
Threat intelligence
Known malicious IP addresses, domains, attack infrastructure and emerging campaigns can add context to suspicious application activity.
Application-layer attacks
- Remote code execution attempts
- Command injection
- Path traversal
- Suspicious file uploads
- Web shell activity
- Malicious outbound communication
- Credential and secret access
Web shell activity
A web shell gives an attacker a persistent command interface through the compromised application. The site can continue serving normal visitors while the shell operates in the background.
Command execution
Unexpected shell commands, scripting engines, package tools or download utilities can indicate that an application vulnerability has progressed to code execution.
Suspicious outbound traffic
A compromised application may contact command-and-control infrastructure, download tools, exfiltrate data or scan other services.
Malicious file uploads
Upload functions should validate file type, content, storage location and execution permissions. An uploaded script should never become executable merely because it reached the application.
Application vulnerabilities
Defender detects suspicious activity, but secure development remains essential. Patch frameworks, libraries, plugins and application code promptly.
Managed identity
Managed identities remove the need to store many static Azure credentials in application settings. Their permissions must still follow least privilege.
App settings and secrets
Secrets stored directly in configuration can be exposed through deployment packages, logs, troubleshooting tools or application compromise.
Azure Key Vault integration
Use Key Vault references and managed identity to reduce direct secret handling. Protect Key Vault access separately and monitor unusual retrieval.
Authentication and authorisation
App Service authentication can provide an identity layer for supported applications, but application-level authorisation must still be designed and tested.
TLS and HTTPS
Require HTTPS, use current TLS settings and maintain valid certificates. Encryption protects data in transit but does not stop application-layer exploitation.
Access restrictions
Restrict inbound access to approved networks, front ends or services where the workload does not need direct public exposure.
Private endpoints
Private endpoints can provide private inbound access for suitable architectures and reduce direct public reachability.
Web Application Firewall
Azure Web Application Firewall can help block common web attacks before they reach the app. It complements rather than replaces secure code and Defender alerts.
Deployment slots
Slots support validation before production swaps. Protect every slot because a forgotten staging endpoint can expose the same code, data or credentials.
CI/CD security
Protect repositories, build agents, service connections, deployment credentials and artefacts. A trusted app can still be compromised through an untrusted pipeline.
Deployment credentials
Publishing profiles and deployment credentials can grant substantial control. Store them securely, rotate them and avoid unnecessary long-lived credentials.
Kudu and SCM endpoint
The App Service SCM site provides powerful deployment and diagnostic capabilities. Restrict access and investigate unexpected use carefully.
Logging
Enable and retain suitable application, HTTP, authentication, deployment and platform logs so alerts can be investigated beyond the initial Defender evidence.
Application Insights
Application Insights can provide request, dependency, exception and performance context that helps distinguish normal faults from malicious activity.
Azure Activity Log
Review control-plane changes such as configuration edits, identity changes, networking updates, deployment actions and Defender plan changes.
Security recommendations
Defender for Cloud produces App Service recommendations for weaknesses such as insecure transport, exposed access, identity gaps and unsafe configuration.
Secure Score
Recommendations can contribute to Secure Score and help prioritise improvements across subscriptions and application estates.
Alert evidence
- App Service resource
- Source IP and location
- Request or attack pattern
- Process or command activity
- Related files
- Outbound destination
- Identity and permissions
- MITRE ATT&CK context
Initial triage
Confirm whether the activity is expected, identify the application owner, establish the affected slot and determine whether the alert represents an attempted or successful compromise.
Request investigation
Review the request path, parameters, headers, source, response code and surrounding traffic. Look for repeated probing followed by a successful request.
Process investigation
Unexpected child processes, shells or download tools may prove the attack moved beyond reconnaissance into code execution.
File investigation
Review recent file changes, deployment packages and uploaded content. Preserve suspicious files before removing or redeploying the app.
Identity investigation
Determine what the app's managed identity or service principal could access and whether those permissions were used after compromise.
Deployment investigation
Review deployment history, source repository activity, build logs, publishing events and slot swaps to rule out pipeline compromise.
Network investigation
Identify outbound destinations, internal resources contacted and whether the app attempted discovery, lateral movement or data exfiltration.
Containment
- Restrict or disable the affected app or slot.
- Block malicious sources and destinations.
- Revoke exposed deployment credentials.
- Rotate affected secrets.
- Remove excessive identity permissions.
- Preserve evidence.
- Redeploy from a trusted build.
Redeployment
Where compromise is confirmed, redeploy a patched application from a trusted repository and pipeline rather than relying only on manual cleanup.
Validation
Confirm the exploit path is closed, suspicious files and processes are gone, identities are constrained, monitoring is working and the clean deployment behaves normally.
Agent Foskett investigation: “The website never went offline…”
↓
No outage was reported
↓
Defender for App Service detected unexpected command execution
↓
The app contacted an unfamiliar external server
↓
Agent Foskett reviewed the Defender alert
↓
A crafted request had reached a vulnerable application endpoint
↓
The request started a shell process
↓
A web shell was written into the application content
↓
The web shell used the app identity to query an internal service
↓
Deployment history showed no approved release
↓
The affected slot was isolated
↓
The managed identity permissions were reduced
↓
Secrets and publishing credentials were rotated
↓
The vulnerable library was patched
↓
The application was rebuilt and redeployed from the trusted pipeline
↓
The website had never gone offline
↓
But someone else had been running code inside it
App Service investigation checklist
| Area | Question | Evidence |
|---|---|---|
| Request | Which request triggered the activity? | Defender alert, HTTP logs and WAF logs. |
| Execution | Did the request start a process or script? | Process evidence, command line and application logs. |
| Files | Were web shells or malicious files created? | File changes, deployment content and forensic copy. |
| Identity | What could the app identity access? | Role assignments, Key Vault access and activity. |
| Deployment | Did the change come from the approved pipeline? | Repository, build, deployment and slot history. |
| Network | What outbound or internal systems were contacted? | Connection telemetry, DNS and application dependencies. |
| Recovery | Can the app be rebuilt from trusted source? | Patched code, trusted artefact and validation testing. |
Key takeaways
- Defender for App Service is natively integrated with Azure App Service.
- It does not require a separate security agent inside the application.
- Platform telemetry and threat intelligence help detect attacks against web apps and APIs.
- Defender alerts supplement secure coding, patching, WAF and network controls.
- Managed identities reduce static credentials but still require least privilege.
- Deployment pipelines, publishing profiles and staging slots are part of the attack surface.
- Unexpected process execution or outbound communication can indicate successful exploitation.
- App Service recommendations help reduce configuration weaknesses.
- Confirmed compromise should normally result in trusted redeployment, credential rotation and permission review.
- A website can remain available while an attacker operates inside the application.
What Agent Foskett checked
- Defender alert
- Request path
- Source IP
- Processes
- File changes
- SCM activity
- Deployment history
- Managed identity
- Secrets
- Outbound traffic
- Activity Log
- Other affected apps
Best practices
- Enable Defender protection.
- Patch code and dependencies.
- Require HTTPS.
- Use WAF where appropriate.
- Restrict network access.
- Use managed identity.
- Store secrets in Key Vault.
- Protect deployment credentials.
- Monitor every slot.
- Redeploy from trusted builds.
Related Agent Foskett resources
Continue learning
What is Microsoft Defender for App Service?
Microsoft Defender for App Service is a Microsoft Defender for Cloud plan that uses native Azure App Service integration, platform telemetry and threat intelligence to detect attacks against hosted web applications and APIs.
Microsoft Defender for App Service Lesson
This Agent Foskett lesson explains App Service threat detection, application attacks, managed identity, deployment security, alert investigation, containment and trusted redeployment.
