What’s Old is New: Hybrid Security for Microsoft Azure and On-Premises Tech
summary
Attackers pivot between on‑prem Active Directory and Azure AD by abusing hidden roles, directory sync accounts and service principals with key material to gain persistence; Mandiant sees ransomware cases follow recon tools (BloodHound, PowerShell), Kerberoasting, WDigest re‑enablement and credential manager dumping. Proofs show a global admin can assume Azure RBAC via user access administrator, enabling VM access and DC credential theft. Defenses that work: disable portal access, monitor service principal sign‑ins, enforce MFA, use cloud‑only admin accounts, PIM, conditional access and compliant devices.
AI-written summary · about
chapters (19)
- 0:00Intro
- 0:24Perfect Storm
- 2:12Active Directory: AD Privileged Account Hierarchy
- 2:54On-Premises: AD Interesting Privileges
- 4:14Cloud: Azure AD Built-In Privileged Roles
- 9:22On-Premises: Active Directory Privilege Escalation Pathways
- 11:30Cloud: Azure Reconnaissance Techniques
- 13:34Cloud: Vertical Movement
- 15:45Cloud: Azure AD Applications and Service Principals
- 17:55Cloud: Connecting using a Service Principal
- 20:09Cloud: Privilege Escalation Hardening
- 20:34Cloud: Password Reset Privileges
- 21:14Cloud: Conditional Access Policies
- 22:46Cloud: Disabling Legacy Authentication
- 28:13On-Premises: Lateral Movement Hardening
- 28:47Cloud: Lateral Movement Hardening
- 29:01Cloud: Azure AD Device Join Types
- 29:31Cloud: Mobile Device Management
- 33:17Cloud: Endpoint - Where's LAPS?
related talks
50mHybrid Active Directory Attacks: Anatomy and Defenses
55mOffensive Azure Security
48mLateral Movement in the Age of Hybrid Cloud
55mAzure Attacks Unpacked: Real-World Threats & Lessons
53mThe Importance of Identity-Centric Security in 2024
51mAdvanced Attack Vectors in Azure Environments
50mAttacking and Defending the Microsoft Cloud (Office 365 & Azure AD)
50mBeyond the Mcse: Active Directory for the Security Professional