Unmask Privileged Access in Azure

What this lab covers

You recover information from an image whose sensitive content was masked rather than removed, use what it reveals to access an Azure environment, and map the attack paths available from there.

The first half is a data handling lesson and the second is Azure reconnaissance. Both are practical, and the combination reflects how many real engagements begin, which is with something an organization published without realising what it contained.

It assumes no prior Azure experience and introduces attack path mapping tooling alongside the CLI.

How redaction failures and Azure recon combine

Image annotation features in several operating systems and applications draw a shape over the image as a separate layer or as a reversible edit. Depending on the tool and how the file is saved, the original pixels or an earlier version may persist in the file, recoverable by anyone who opens it properly.

Screenshots are shared constantly: in tickets, documentation, blog posts, conference slides and support threads. Each is a potential disclosure, and the person masking a password reasonably believes a black box over it is sufficient.

Once credentials are recovered, Azure reconnaissance follows a predictable path. Tooling collects directory objects and the relationships between them, then presents the graph of who can reach what. The value is that transitive escalation paths become visible, which no portal view provides.

How to detect this in your own environment

This begins outside your environment, so the observable stage is the authentication that follows. A sign-in from an unfamiliar location using credentials that have not been rotated is where it becomes visible to you.

Watch for directory enumeration after an unusual sign-in. Reconnaissance immediately following a sign-in anomaly is a considerably stronger signal than either event alone.

Scan your own published material. Reviewing what your organization has posted publicly is a control you can exercise directly, unlike detection of the disclosure itself.

How to prevent it

Crop rather than cover. Removing the region entirely, or replacing it in an editor that flattens the image, is the only reliable approach, and exporting to a format that discards layers helps.

Establish a rule that credentials are never present in screenshots at all, rather than relying on masking. If the password was never on screen, redaction quality stops mattering.

Rotate anything that has appeared in a shared image, on the assumption that it was recoverable. Treat it as an exposure rather than a near miss.

Real-world context

Redaction failures have caused real disclosures across many contexts, including cases where masking applied by common tools proved reversible. The general lesson recurs whenever a new annotation feature is widely adopted.

The Azure half reflects standard practice. Attack path mapping is used by defenders and attackers alike, and running it against your own tenant is one of the fastest ways to find escalation routes that permission reviews miss.

The pattern maps to MITRE ATT&CK T1592 Gather Victim Host Information, T1078.004 Cloud Accounts and T1087 Account Discovery.

Applying this at work

• Set a rule that screenshots never contain credentials, rather than relying on redaction.
• Review images in your public documentation, blog posts and support threads for masked content.
• Rotate any credential that has appeared in a shared image.
• Run attack path mapping against your own tenant and remediate the shortest paths to privileged roles.
• Alert on directory enumeration following an unusual sign-in.

Frequently asked questions

Why does drawing over a password not remove it?

Because several annotation tools store the markup as a separate layer or reversible edit, leaving the original image data in the file. Opening the file appropriately can recover what appears to be covered.

What is the safe way to redact an image?

Crop the region out entirely, or edit and flatten the image in a tool that discards layers, then export to a format that cannot retain the original. Better still, avoid capturing sensitive content in the first place.

Why run attack path mapping on my own tenant?

Because escalation paths are transitive and no portal view shows them. Mapping the graph reveals routes from ordinary users to privileged roles that reviewing assignments one at a time will not surface.

Do I need my own Azure account to practice this?

No. The lab runs in a live Azure environment that Pwned Labs provisions for you, so there is nothing to set up and no risk to your own tenant.

Which certification covers this in depth?

The Microsoft Cloud Red Team Professional (MCRTP) covers Entra ID, Azure and Microsoft 365 attack paths in full, including token abuse, phishing tradecraft and privilege escalation, and is assessed hands-on in a live tenant.