Writing Your Own Ticket to the Cloud Like APT: A Dive to AD FS Attacks, Detections, and Mitigations
summary
Eighty-eight percent of Fortune 500s use Azure AD and ~68% of those use federation, so AD FS remains a high-value target. The workflow shows four practical ways to steal token‑signing material: read the AD FS config DB (WID/SQL), use .NET reflection to dump private service properties, call the PolicyStoreTransfer WCF service over port 80, or enumerate the AD DKM object via LDAP/DC replication. Detections map to events 4103/4104, 4624/624, 121, 4662; mitigations include blocking port 80, tightening SQL access, marking private keys non‑exportable and using HSM. Tools shown: AadInternals, AD FS dump, mimikatz.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 10:23Namepipe Connections
- 12:13Dotnet Reflection
- 14:35Powershell
- 17:50Synchronization
- 20:34Network Connection
- 27:52Key
- 32:19Remote Method
- 38:02Mitigations
related talks
50mAttacking and Defending the Microsoft Cloud (Office 365 & Azure AD)
23mHacking Exposed: Next-Generation Tactics, Techniques, and Procedures
55mOffensive Azure Security
40mTop Active Directory Attacks: Understand, then Prevent and Detect
50mBeyond the Mcse: Active Directory for the Security Professional
50mHybrid Active Directory Attacks: Anatomy and Defenses
53mThe Importance of Identity-Centric Security in 2024
51mAdvanced Attack Vectors in Azure Environments