ADTRUST-007: Azure AD Hybrid Trust Security
- Platform
- Active Directory
- Category
- AD Trust Relationships
- Severity
- Medium
- Zero Trust pillar
- Identity (weight 3)
- Golden fixtures
- 3
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
The check inventories four hybrid identity components. First, it locates the Entra Connect Sync server by querying for the on-prem service account (typically MSOL_<hex> in the Users container) and the connector account (AAD_<hex> or Sync_<hostname>_<hex>), reads the host OS build, the AAD Connect installed version from HKLM:\SOFTWARE\Microsoft\Azure AD Connect, the membership of the local Administrators group on the sync host, and whether the host is dual-purpose (DC, file server, RDS, application server). Second, it lists Pass-Through Authentication agents registered to the tenant via Get-AzureADPasswordProtectionProxy / Get-MgDirectoryOnPremisesSynchronization and surfaces the agent host names and versions. Third, it enumerates AD FS farm members, reads the token-signing and token-decrypting certificate thumbprints, and pulls the certificate sharing key from the WID or SQL configuration database to flag whether DKM key material is recoverable from a backup. Fourth, it queries the AZUREADSSOACC$ computer account, reads pwdLastSet, and compares against the current date: any value older than 30 days violates Microsoft guidance. Finally, the check enumerates Global Administrator role assignments via Microsoft Graph and verifies that at least one assignment is a cloud-only identity (no onPremisesSyncEnabled flag and no immutableId) for break-glass continuity.
Why it matters
The Entra Connect server is the single most under-defended Tier 0 asset in most enterprises. The MSOL_ account synced to the on-prem directory holds Replicating Directory Changes and Replicating Directory Changes All rights on the domain naming context, which is DCSync. The AAD Sync service account holds Global Administrator equivalent permissions in the tenant. The DKM (Distributed Key Manager) key used by AD FS to protect the token-signing private key lives in AD under CN=ADFS,CN=Microsoft,CN=Program Data,DC=<domain> and any Domain Admin can extract it. Once an attacker controls the token-signing certificate, the Golden SAML technique (Mandiant, SolarWinds/UNC2452) lets them mint SAML responses for any user in any federated tenant, including Global Administrators, without ever touching the cloud control plane and without generating Entra ID sign-in logs that mark the authentication as suspicious. Pass-Through Authentication, if Seamless SSO is enabled, persists a domain computer account (AZUREADSSOACC) whose Kerberos key is functionally equivalent to a krbtgt for the tenant: Nestori Syynimaa demonstrated that an attacker with the NTLM hash of AZUREADSSOACC$ can forge a silver ticket for any user and authenticate to Entra ID. Hybrid attacks are bidirectional: on-prem compromise becomes tenant compromise, and tenant compromise (via a malicious PTA backdoor) becomes on-prem credential harvesting.
Attack path
On-prem to cloud (Golden SAML, AD FS path). Step 1: The attacker gains Domain Admin or Tier 0 access on the AD FS server or any DC. Step 2: They use ADFSDump or AADInternals Export-AADIntADFSCertificates to extract the token-signing certificate and the DKM master key from AD. Step 3: They use AADInternals New-AADIntSAMLToken to mint a SAML response asserting any UPN, including a Global Administrator. Step 4: They present the SAML token to login.microsoftonline.com and obtain access and refresh tokens for any Microsoft 365 or Azure service. The sign-in log shows authMethod federated and originates from the attacker IP, but the legitimate token-signing certificate makes the assertion cryptographically valid. On-prem to cloud (AAD Connect path). Step 1: The attacker compromises the Entra Connect server (often via SMB lateral movement to a Tier 1 host the admin RDPs to). Step 2: They extract the AD DS connector account password from the ADSync SQL database using AADInternals Get-AADIntSyncCredentials, which decrypts the credentials stored under HKLM:\SOFTWARE\Microsoft\Azure AD Connect using the DPAPI key of the ADSync service account. Step 3: With the MSOL_ password they perform DCSync against any DC and dump krbtgt for forest-wide Golden Ticket capability. Cloud to on-prem (PTA backdoor). Step 1: The attacker compromises a single PTA agent host with local admin. Step 2: They patch the PTA agent DLL in memory using AADInternals Install-AADIntPTASpy to log every plaintext password validated through the agent and to optionally accept any password for any user. Step 3: They harvest plaintext on-prem credentials for any user signing in to Entra ID until the agent restarts. Seamless SSO silver ticket. Step 1: The attacker obtains the NTLM hash of AZUREADSSOACC$ via DCSync or by reading the local SAM on a DC. Step 2: They use AADInternals New-AADIntKerberosTicket or Mimikatz to forge a Kerberos service ticket for HTTP/autologon.microsoftazuread-sso.com with any UPN. Step 3: They present the ticket to login.microsoftonline.com and authenticate as the chosen user, bypassing MFA when conditional access is not enforced on the AZUREADSSOACC sign-in path.
How Guerrilla assesses it
Guerrilla detects hybrid identity components through a layered enumeration. It first runs an LDAP query against the default naming context for (sAMAccountName=MSOL_*) and (sAMAccountName=AAD_*) to locate the on-prem connector accounts and reads servicePrincipalName entries to identify the host running ADSync. It then connects to that host over WSMan or remote registry to read HKLM:\SOFTWARE\Microsoft\Azure AD Connect\Shared\InstalledVersion and HKLM:\SOFTWARE\Microsoft\Active Directory Federation Services to confirm the installed product versions. For AD FS, the check queries (objectClass=container)(cn=ADFS) under CN=Microsoft,CN=Program Data and reads thumbnailPhoto and msDS-ManagedPassword for DKM key recoverability. For Seamless SSO, the check binds to (sAMAccountName=AZUREADSSOACC$) and reads pwdLastSet, converting the FILETIME to a UTC datetime and computing age in days. For tenant-side validation, the check uses Microsoft Graph (GET /directoryRoles/{globalAdminId}/members) and inspects each principal for onPremisesSyncEnabled and onPremisesImmutableId; if every Global Administrator has those set, a finding is raised because no cloud-only break-glass identity exists. The PTA agent list is pulled from GET /directory/onPremisesSynchronization or the legacy Get-AzureADPasswordProtectionProxy cmdlet.
Recommended value
Azure AD Connect running latest version on a hardened, dedicated server. PHS preferred over PTA/federation. Seamless SSO disabled if not required. Cloud-only break-glass accounts configured
Remediation
Review Azure AD Connect configuration and ensure it runs on a Tier 0 hardened server. Evaluate switching from federation or PTA to Password Hash Sync (PHS) for reduced attack surface. If using Seamless SSO, ensure the AZUREADSSOACC computer account password is rotated. Verify cloud-only emergency access accounts exist
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| known-bad | WARN |
| throttled | Not Assessed |
Framework mappings
- NIST SP 800-53
- IA-2, AC-20, SC-8
- CIS AD Benchmark
- 3.3.1
- MITRE ATT&CK
- T1078.004, T1649