How Nation States Use Your Domain to Compromise Your Cloud Infrastructure
summary
Nation-state intrusions start from a compromised on‑prem AD (often via supply‑chain) and pivot to Azure AD by modifying existing OAuth apps or adding client secrets, granting mail.read to harvest mail via Microsoft Graph; detection relies on unified audit logs, E5-only mailItemsAccess records, and current‑artifact checks using tools like Hawk, Sparrow, Mandiant, or CrowdStrike’s investigator. Watch for the event update application certificates and secrets management and for golden SAML activity; disable legacy auth and require admin consent for apps.
AI-written summary · about
chapters (12)
- 0:00Introduction and speaker background
- 2:50Focus on Azure AD and Office 365 attacks
- 10:19Wire fraud attacks explained
- 17:01Detecting wire fraud in Office 365
- 19:09Bypassing MFA in Office 365
- 27:01Ransomware actors using email
- 31:14Nation state attack behaviors
- 35:04Golden SAML attack explained
- 41:47OAuth application abuse demo
- 44:44Detecting nation state persistence
- 54:40Preventing nation state attacks
- 58:59Q&A and conclusion
related talks
50mAttacking and Defending the Microsoft Cloud (Office 365 & Azure AD)
40mWhat’s Old is New: Hybrid Security for Microsoft Azure and On-Premises Tech
55mOffensive Azure Security
51mAdvanced Attack Vectors in Azure Environments
48mLateral Movement in the Age of Hybrid Cloud
42mWriting Your Own Ticket to the Cloud Like APT: A Dive to AD FS Attacks, Detections, and Mitigations
50mHybrid Active Directory Attacks: Anatomy and Defenses
37mThreat Hunting in Active Directory Environment