The kill chain model maps how an attack can progress through a cloud environment: exposure, access, lateral movement, actions on objective, and goal. It helps teams consider both an attacker’s entry point and the damage they may pursue after gaining control. section 1.5
Use the model to plan defenses across the full attack path:
- Protect against exposure and access, rather than assuming attackers begin outside the environment. section 1.8
- Limit lateral movement between resource types, including infrastructure, data, applications, networking, and identities. section 1.5 section 1.8
- Apply multiple controls at every stage across workload security, threat monitoring and detection, and investigation and response. section 1.8
Open VM port to crypto mining
A publicly reachable VM can expose an account to password guessing. After compromising the account, an attacker can install malware, move to further resources such as Kubernetes clusters, deploy a malicious container image, and run a crypto miner that creates financial cost. section 1.5
For identity attacks, suspicious sign-ins can trigger MFA through Microsoft Entra ID. Identity protection can require a password change for potentially compromised privileged identities, while Microsoft Sentinel can detect phishing-driven lateral movement and automate containment. These controls complement one another; no single service stops every stage. section 1.8.1
Figure 1.2 The kill chain model helps visualize the steps that bad actors may perform to compromise your Azure environment.
View the five-stage attack path as a compact cloud-security planning model. section 1.5
