Make sure that you have firewall rules and NSG rules open\u00a0<\/em>to allow your “attacks” – the point of IDPS is to stop traffic on legitimate protocols\/ports.<\/p>\n One can use Kali Linux from the Azure Marketplace<\/a> but I prefer to work in Windows. So I deployed a Windows Server VM and downloaded\/deployed Metasploit Opensource<\/a>, which is installed into C:\\metasploit-framework.<\/p>\n The console that you’ll use to run the commands is C:\\metasploit-framework\\bin\\msfconsole.bat.<\/p>\n If you want to trying something simpler, then all you will need is the normal Windows Command prompt.<\/p>\n If you are using Metasploit, in the console, run the following to search for “coldfusion” tests:<\/p>\n search coldfusion<\/em><\/p>\n Select a test:<\/p>\n use auxiliary\/scanner\/http\/coldfusion_locale_traversal<\/em><\/p>\n Set the RHOST (remote host to target) option:<\/p>\n set RHOST <IP address to target><\/em><\/p>\n Verify that all required options are set:<\/p>\n show options<\/em><\/p>\n Execute the test:<\/p>\n run<\/p>\n Otherwise, you can run the following CURL command in Windows Command Prompt for a simpler test to do a web request to your target IP using the well-known Blacksun user agent:<\/p>\n curl -A “BlackSun” <IP address to target><\/em><\/p>\n It can take a little time for data to appear in your logs. Give it a few minutes and then run this query in Log Analytics:<\/p>\n AzureDiagnostics\u00a0| where ResourceType == “AZUREFIREWALLS” | where OperationName == “AzureFirewallIDSLog”\u00a0| parse msg_s with Protocol ” request from” SourceIP “:” SourcePort ” to ” TargetIP “:” TargetPort “. Action:” Action”. Signature: ” Signature “. IDS:” Reason\u00a0| project TimeGenerated, Protocol, SourceIP, SourcePort, TargetIP, TargetPort, Action, Signature, Reason\u00a0| sort by TimeGenerated<\/p>\n That should highlight anything that IDPS alerted on & denied – and can also be useful for creating incidents in Azure Sentinel.<\/p>\n","protected":false},"excerpt":{"rendered":" In this post, I will show you how to test IDPS in Azure Firewall Premium, including test exploits and how to search the logs for alerts. Azure Firewall Setup You are going to need a few things: Ideally a hub and spoke deployment of some kind, with a virtual machine in two different spokes. My … Continue reading “Testing Azure Firewall IDPS”<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":22423,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"_wpcom_ai_launchpad_first_post":false,"footnotes":""},"categories":[5],"tags":[306,476,423,479],"class_list":["post-22414","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-azure","tag-azure-firewall","tag-idps","tag-log-analytics","tag-metasploit"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\tCompromised On-Premises Machine<\/h2>\n
The Exploit Test<\/h2>\n
Check Your Logs<\/h2>\n
![\"\"](\"https:\/\/aidanfinn.com\/wp-content\/uploads\/2021\/07\/AzureFirewallIDPSBlockingMetasploit.png\")
<\/a><\/p>\n