Attacking and Defending the Microsoft Cloud (Office 365 & Azure AD)
summary
Scans of public DNS and MX/TXT records reveal installed SaaS and federation setups; extracting ADFS token‑signing certs enables golden SAML with tools like ATF spoof and modified ADFS adapters for persistence. AD Connect (Express) creates MSOL accounts and can sync password hashes — treat that server as a tier‑0 DC. Attackers use O365 creeper, mail‑sniper and legacy protocols to password spray (200k+ accounts seen monthly; recent months 120k–212k), so enable Azure AD Connect password‑hash sync, disable legacy auth, enforce MFA/PIM and ingest sign‑in logs.
AI-written summary · about
chapters (20)
- 0:00Introduction
- 1:00Overview
- 5:30DNS
- 15:50Password Spraying
- 21:27Cloud Administration
- 25:14App Permissions
- 30:30Conditional Access
- 34:39Breach Replay
- 34:51Password Hashing
- 38:09MFA
- 39:15Monitoring
- 40:07TFS
- 40:51Password Policy
- 41:29Azure AD Ban Password Policy
- 42:18Azure AD Domain Controllers
- 43:25Password Spray
- 44:36How to Block Password Spray
- 45:16Authorization Rules
- 45:50Blocking Legacy Authentication
- 47:05Wrap Up
related talks
55mOffensive Azure Security
42mWriting Your Own Ticket to the Cloud Like APT: A Dive to AD FS Attacks, Detections, and Mitigations
23mHacking Exposed: Next-Generation Tactics, Techniques, and Procedures
50mHybrid Active Directory Attacks: Anatomy and Defenses
01h 00mHow Nation States Use Your Domain to Compromise Your Cloud Infrastructure
40mWhat’s Old is New: Hybrid Security for Microsoft Azure and On-Premises Tech
40mTop Active Directory Attacks: Understand, then Prevent and Detect
51mAdvanced Attack Vectors in Azure Environments