Lesson 35 — Investigating Attack Paths
Security recommendations often look like separate configuration issues. Attack-path analysis shows how those issues can combine into a realistic route toward a high-impact resource.
Microsoft Defender for Cloud uses the cloud security graph to analyse relationships between resources, identities, permissions, internet exposure and security findings. The resulting attack paths help security teams understand where an attacker could begin, how they could move and which recommendations would break the path.
This lesson explains how to read attack-path nodes and relationships, investigate entry points and permissions, prioritise high-impact paths and validate that remediation has actually removed the exploitable route.
What you will learn
This lesson follows an attack path from exposed entry point through identity, permissions and connected high-value assets.
Attack-path investigation workflow
↓
Select a high-risk or business-critical path
↓
Read the path title and identify the entry point
↓
Review each node and relationship
↓
Validate internet exposure, identities and permissions
↓
Confirm the high-impact target and business context
↓
Review every recommendation connected to the path
↓
Identify the strongest remediation choke point
↓
Assign ownership and complete remediation
↓
Wait for reassessment
↓
Confirm the path is removed or reduced
↓
Document residual risk and evidence
Attack-path components
| Component | What it represents | Investigation question |
|---|---|---|
| Entry point | The first reachable or compromisable asset. | Can an attacker realistically reach it? |
| Node | A resource, identity or security entity. | What role does this asset play? |
| Relationship | A permission, network or trust connection. | Why can one node reach the next? |
| Recommendation | A security action that reduces or breaks risk. | Which fix removes the path? |
| High-impact target | A critical resource or privileged capability. | What would the attacker gain? |
| Business context | Criticality, sensitivity and production value. | How urgent is this path? |
Learning objectives
- Explain attack-path analysis.
- Distinguish attack paths from security alerts.
- Read nodes, edges and recommendations.
- Identify entry points and high-impact assets.
- Investigate identities and permissions.
- Prioritise remediation that breaks the path.
- Validate that the attack path has disappeared.
What is an attack path?
An attack path is a sequence of exploitable relationships that could allow an attacker to move from an entry point toward a high-impact resource.
Proactive analysis
Attack paths identify potential routes before compromise is confirmed. They are exposure findings, not proof that an attacker has already followed the route.
Attack paths versus alerts
An alert reports suspicious or malicious activity that was detected. An attack path shows how current weaknesses and relationships could be exploited.
Attack paths versus recommendations
A recommendation identifies a security issue. An attack path explains how several issues and relationships can combine into greater risk.
Attack paths versus Secure Score
Cloud Secure Score measures posture improvement opportunities. Attack paths focus on exploitable routes and business impact.
Cloud security graph
The cloud security graph connects assets, identities, permissions, network exposure, vulnerabilities and configuration findings across supported environments.
Graph-based analysis
Defender uses graph relationships to identify routes that might not be visible when resources are reviewed individually.
Nodes
Nodes represent entities such as virtual machines, storage accounts, databases, Key Vaults, containers, identities, subscriptions and other resources.
Edges
Edges represent relationships such as can access, can administer, is assigned to, is exposed to or contains a sensitive secret.
Entry points
An entry point is a resource or identity that an attacker could reach or compromise first, such as an internet-facing workload or exposed credential.
High-impact resources
High-impact resources can include privileged identities, sensitive data stores, production systems, critical Key Vaults and administrative control planes.
Internet exposure
Public IP addresses, open management ports, internet-facing services and public storage can create an initial access route.
Identity exposure
Compromised users, service principals and managed identities can provide access to resources far beyond the original workload.
Azure RBAC
Contributor, Owner and other broad roles can allow an attacker to modify resources, assign identities or create new access paths.
Inherited permissions
Permissions inherited from management groups, subscriptions and resource groups can affect many resources even when no direct assignment is visible.
Managed identities
A compromised workload can use its managed identity to access Key Vaults, storage, databases and control-plane operations.
Service principals
Applications with broad permissions or exposed credentials can become powerful steps within an attack path.
Secrets
Secrets discovered in code, scripts, environment variables, disks or configuration can lead to other identities and systems.
Key Vault relationships
Access to a Key Vault can expose credentials, signing material or certificates that unlock downstream resources.
Storage relationships
Storage accounts may contain backups, deployment packages, scripts, data exports or credentials that extend the path.
Database relationships
Database access can expose sensitive information or credentials stored by applications and operational systems.
Container relationships
A vulnerable image, privileged pod or over-permissioned service account can create movement from a container workload to the cluster or cloud account.
Vulnerability context
A vulnerability becomes more urgent when it affects an exposed, running workload connected to privileged identities or sensitive data.
Configuration context
Public access, weak network restrictions, missing MFA and unsafe role assignments can combine with vulnerabilities to create a route.
Business context
Production importance, data sensitivity and operational criticality affect which paths should be remediated first.
Attack-path status
Review whether a path is active, newly discovered, changed or resolved according to the current Defender experience and data refresh.
Path title
The path title summarises the entry condition, progression and high-impact target. Read it before examining individual nodes.
Node details
Select each node to review resource type, exposure, permissions, recommendations and relevant security findings.
Relationship details
Understand why Defender connected two nodes. The relationship often reveals the actual movement opportunity.
Recommendations
Attack paths include the recommendations that can reduce risk or break one or more steps within the route.
Two recommendation types
Review both recommendations that break the path directly and recommendations that reduce associated risk or harden the affected assets.
Choke points
A choke point is a node or relationship whose remediation can break several possible paths at once.
Prioritisation
Prioritise internet-facing paths, privileged identities, sensitive data and routes with fewer or easier exploitation steps.
Shortest path
A short path can represent fewer required attacker actions, but ease of exploitation and business impact still require validation.
Multiple paths
One resource can participate in several attack paths. Remediating a shared cause can remove several routes.
Cross-subscription paths
Identities and shared services can connect resources across subscriptions and management boundaries.
Multicloud paths
Connected cloud environments can reveal exposure relationships across Azure, AWS and Google Cloud where supported.
Cloud Security Explorer
Cloud Security Explorer can query graph relationships and help test hypotheses related to resources, permissions and exposure.
Recommendation graph
Use graph views in recommendations to understand the context behind risk prioritisation, including associated attack paths.
Validate the entry point
Confirm that the resource is genuinely reachable or exploitable from the source described by the path.
Validate the identity
Confirm the identity assignment, current permissions, credential type and whether the workload can actually request a usable token.
Validate the target
Confirm the downstream resource contains sensitive data, privileged capability or meaningful business impact.
False assumptions
Network routing, disabled identities, expired credentials or application controls may reduce exploitability. Document the evidence rather than ignoring the path.
Remediate public exposure
Remove public endpoints, restrict firewall rules, use private connectivity and close unnecessary management ports.
Remediate permissions
Remove broad roles, reduce assignment scope, use custom roles and apply privileged access workflows.
Remediate identities
Disable unused identities, rotate credentials, remove old app registrations and restrict managed identity permissions.
Remediate secrets
Remove exposed secrets, rotate affected material and replace static credentials with managed identity where practical.
Remediate vulnerabilities
Patch or replace exposed workloads and prioritise vulnerabilities that participate in an active attack path.
Network segmentation
Restrict east-west communication and administrative paths so compromise of one workload does not provide broad reach.
JIT access
Use Just-In-Time VM Access or private administration paths to reduce continuous exposure of management ports.
PIM and MFA
Use Privileged Identity Management, MFA and Conditional Access to reduce standing privilege and identity compromise risk.
Validation after remediation
Wait for Defender reassessment and confirm the attack path is removed or materially changed.
Residual risk
If the path remains, investigate alternate nodes, inherited permissions, cached credentials or a second unresolved recommendation.
Exception management
Document accepted attack-path risk with owner, justification, compensating controls and expiry date.
Reporting
Report the path, high-impact target, remediation owner, due date and evidence that the route was broken.
Agent Foskett investigation: “Nothing was compromised…”
↓
An Azure virtual machine was exposed to the internet
↓
The VM had an unpatched remote-code-execution vulnerability
↓
The VM also had a system-assigned managed identity
↓
That identity had Contributor rights at resource-group scope
↓
The resource group contained a production Key Vault
↓
The Key Vault stored a storage-account credential
↓
The storage account contained customer exports and deployment packages
↓
A deployment package contained credentials for production SQL
↓
Agent Foskett validated every node and relationship
↓
No alert showed that the route had been used
↓
The Contributor assignment was removed
↓
The VM vulnerability was patched
↓
Internet management access was closed
↓
The Key Vault and storage credentials were rotated
↓
Defender reassessed the environment
↓
The attack path disappeared
↓
Nothing had been compromised
↓
Because the route was broken before an attacker used it
Attack-path investigation checklist
| Area | Question | Evidence |
|---|---|---|
| Entry point | What can the attacker reach first? | Internet exposure, credentials or vulnerability findings. |
| Resource | Which asset begins or continues the path? | Node details and resource inventory. |
| Identity | Which user, service principal or managed identity is involved? | Assignments, credentials and token access. |
| Relationship | Why can one node access the next? | RBAC, network, secret or trust relationship. |
| Target | What high-impact asset could be reached? | Data sensitivity and business criticality. |
| Recommendation | Which action breaks the path? | Attack-path remediation list. |
| Choke point | Can one fix remove several paths? | Shared identity, role or exposed resource. |
| Validation | Did Defender remove or change the path? | Reassessment and updated graph. |
Key takeaways
- Attack paths identify potential routes toward high-impact cloud resources.
- They use cloud security graph relationships between assets, identities, permissions and exposure.
- Attack paths are proactive findings, not proof of completed compromise.
- Nodes represent resources and identities; edges represent their relationships.
- Entry points commonly involve internet exposure, vulnerabilities or compromised credentials.
- High-impact targets include sensitive data and privileged control.
- Recommendations show how to reduce or break the path.
- Choke-point remediation can remove several routes at once.
- Business criticality and exploitability determine priority.
- Remediation is complete only when Defender reassessment confirms the path is removed or reduced.
What Agent Foskett checked
- Path title
- Entry point
- Internet exposure
- Vulnerabilities
- Managed identities
- Service principals
- RBAC assignments
- Key Vault access
- Storage contents
- High-impact target
- Recommendations
- Reassessment status
Best practices
- Review high-risk paths regularly.
- Validate every relationship.
- Prioritise internet-facing paths.
- Reduce standing privilege.
- Restrict managed identities.
- Remove exposed secrets.
- Use private connectivity.
- Patch path-related vulnerabilities.
- Target choke points.
- Confirm the path disappears.
Related Agent Foskett resources
Continue learning
What is attack-path analysis in Microsoft Defender for Cloud?
Attack-path analysis uses the cloud security graph to identify exploitable routes between exposed resources, identities, permissions, vulnerabilities and high-impact assets.
Investigating Attack Paths Lesson
This Agent Foskett lesson explains attack-path nodes, relationships, entry points, high-impact targets, identities, permissions, recommendations, choke points, remediation and reassessment.
