Make sure that you have firewall rules and NSG rules open\u00a0<\/em>to allow your “attacks” – the point of IDPS is to stop traffic on legitimate protocols\/ports.<\/p>\n One can use Kali Linux from the Azure Marketplace<\/a> but I prefer to work in Windows. So I deployed a Windows Server VM and downloaded\/deployed Metasploit Opensource<\/a>, which is installed into C:\\metasploit-framework.<\/p>\n The console that you’ll use to run the commands is C:\\metasploit-framework\\bin\\msfconsole.bat.<\/p>\n If you want to trying something simpler, then all you will need is the normal Windows Command prompt.<\/p>\n If you are using Metasploit, in the console, run the following to search for “coldfusion” tests:<\/p>\n search coldfusion<\/em><\/p>\n Select a test:<\/p>\n use auxiliary\/scanner\/http\/coldfusion_locale_traversal<\/em><\/p>\n Set the RHOST (remote host to target) option:<\/p>\n set RHOST <IP address to target><\/em><\/p>\n Verify that all required options are set:<\/p>\n show options<\/em><\/p>\n Execute the test:<\/p>\n run<\/p>\n Otherwise, you can run the following CURL command in Windows Command Prompt for a simpler test to do a web request to your target IP using the well-known Blacksun user agent:<\/p>\n curl -A “BlackSun” <IP address to target><\/em><\/p>\n It can take a little time for data to appear in your logs. Give it a few minutes and then run this query in Log Analytics:<\/p>\n AzureDiagnostics\u00a0| where ResourceType == “AZUREFIREWALLS” | where OperationName == “AzureFirewallIDSLog”\u00a0| parse msg_s with Protocol ” request from” SourceIP “:” SourcePort ” to ” TargetIP “:” TargetPort “. Action:” Action”. Signature: ” Signature “. IDS:” Reason\u00a0| project TimeGenerated, Protocol, SourceIP, SourcePort, TargetIP, TargetPort, Action, Signature, Reason\u00a0| sort by TimeGenerated<\/p>\n That should highlight anything that IDPS alerted on & denied – and can also be useful for creating incidents in Azure Sentinel.<\/p>\n","protected":false},"excerpt":{"rendered":" In this post, I will show you how to test IDPS in Azure Firewall Premium, including test exploits and how to search the logs for alerts. Azure Firewall Setup You are going to need a few things: Ideally a hub and spoke deployment of some kind, with a virtual machine in two different spokes. My … Continue reading “Testing Azure Firewall IDPS”<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":22423,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"footnotes":""},"categories":[5],"tags":[306,476,423,479],"class_list":["post-22414","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-azure","tag-azure-firewall","tag-idps","tag-log-analytics","tag-metasploit"],"aioseo_notices":[],"jetpack_featured_media_url":"https:\/\/aidanfinn.com\/wp-content\/uploads\/2021\/07\/MetasploitIDPSFirewall.png","amp_enabled":true,"_links":{"self":[{"href":"https:\/\/aidanfinn.com\/index.php?rest_route=\/wp\/v2\/posts\/22414","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/aidanfinn.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/aidanfinn.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/aidanfinn.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/aidanfinn.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=22414"}],"version-history":[{"count":8,"href":"https:\/\/aidanfinn.com\/index.php?rest_route=\/wp\/v2\/posts\/22414\/revisions"}],"predecessor-version":[{"id":22424,"href":"https:\/\/aidanfinn.com\/index.php?rest_route=\/wp\/v2\/posts\/22414\/revisions\/22424"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/aidanfinn.com\/index.php?rest_route=\/wp\/v2\/media\/22423"}],"wp:attachment":[{"href":"https:\/\/aidanfinn.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=22414"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/aidanfinn.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=22414"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/aidanfinn.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=22414"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}Compromised On-Premises Machine<\/h2>\n
The Exploit Test<\/h2>\n
Check Your Logs<\/h2>\n
![\"\"](\"https:\/\/aidanfinn.com\/wp-content\/uploads\/2021\/07\/AzureFirewallIDPSBlockingMetasploit.png\")
<\/a><\/p>\n