In this post, I will show you how to test IDPS in Azure Firewall Premium, including test exploits and how to search the logs for alerts.
Azure Firewall Setup
You are going to need a few things:
- Ideally a hub and spoke deployment of some kind, with a virtual machine in two different spokes. My lab is Azure Virtual WAN, using a VNet as the “compromised on-premises” and a second VNet as the target.
- Azure Firewall Premium SKU with logging enabled to a Log Analytics Workspace.
- Azure Firewall Policy Premium SKU, with IDPS enabled for Alert & Deny.
Make sure that you have firewall rules and NSG rules open to allow your “attacks” – the point of IDPS is to stop traffic on legitimate protocols/ports.
Compromised On-Premises Machine
One can use Kali Linux from the Azure Marketplace but I prefer to work in Windows. So I deployed a Windows Server VM and downloaded/deployed Metasploit Opensource, which is installed into C:\metasploit-framework.
The console that you’ll use to run the commands is C:\metasploit-framework\bin\msfconsole.bat.
If you want to trying something simpler, then all you will need is the normal Windows Command prompt.
The Exploit Test
If you are using Metasploit, in the console, run the following to search for “coldfusion” tests:
search coldfusion
Select a test:
use auxiliary/scanner/http/coldfusion_locale_traversal
Set the RHOST (remote host to target) option:
set RHOST <IP address to target>
Verify that all required options are set:
show options
Execute the test:
run
Otherwise, you can run the following CURL command in Windows Command Prompt for a simpler test to do a web request to your target IP using the well-known Blacksun user agent:
curl -A “BlackSun” <IP address to target>
Check Your Logs
It can take a little time for data to appear in your logs. Give it a few minutes and then run this query in Log Analytics:
AzureDiagnostics | where ResourceType == “AZUREFIREWALLS” | where OperationName == “AzureFirewallIDSLog” | parse msg_s with Protocol ” request from” SourceIP “:” SourcePort ” to ” TargetIP “:” TargetPort “. Action:” Action”. Signature: ” Signature “. IDS:” Reason | project TimeGenerated, Protocol, SourceIP, SourcePort, TargetIP, TargetPort, Action, Signature, Reason | sort by TimeGenerated
That should highlight anything that IDPS alerted on & denied – and can also be useful for creating incidents in Azure Sentinel.