ADTRUST-007: Seguridad de la confianza híbrida con Azure AD
- Plataforma
- Active Directory
- Categoría
- AD Trust Relationships
- Severidad
- Medium
- Pilar de Zero Trust
- Identity (peso 3)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Las configuraciones de identidad híbrida que conectan Active Directory local con Azure AD crean rutas de ataque adicionales. Azure AD Connect, los agentes de autenticación de paso a través y los servicios de federación pueden ser objetivo de ataques para pivotar entre los entornos de nube y locales
Por qué importa
The Entra Connect server is the single most under-defended Tier 0 asset in most enterprises. The MSOL_ account synced to the on-prem directory holds Replicating Directory Changes and Replicating Directory Changes All rights on the domain naming context, which is DCSync. The AAD Sync service account holds Global Administrator equivalent permissions in the tenant. The DKM (Distributed Key Manager) key used by AD FS to protect the token-signing private key lives in AD under CN=ADFS,CN=Microsoft,CN=Program Data,DC=<domain> and any Domain Admin can extract it. Once an attacker controls the token-signing certificate, the Golden SAML technique (Mandiant, SolarWinds/UNC2452) lets them mint SAML responses for any user in any federated tenant, including Global Administrators, without ever touching the cloud control plane and without generating Entra ID sign-in logs that mark the authentication as suspicious. Pass-Through Authentication, if Seamless SSO is enabled, persists a domain computer account (AZUREADSSOACC) whose Kerberos key is functionally equivalent to a krbtgt for the tenant: Nestori Syynimaa demonstrated that an attacker with the NTLM hash of AZUREADSSOACC$ can forge a silver ticket for any user and authenticate to Entra ID. Hybrid attacks are bidirectional: on-prem compromise becomes tenant compromise, and tenant compromise (via a malicious PTA backdoor) becomes on-prem credential harvesting.
Ruta de ataque
On-prem to cloud (Golden SAML, AD FS path). Step 1: The attacker gains Domain Admin or Tier 0 access on the AD FS server or any DC. Step 2: They use ADFSDump or AADInternals Export-AADIntADFSCertificates to extract the token-signing certificate and the DKM master key from AD. Step 3: They use AADInternals New-AADIntSAMLToken to mint a SAML response asserting any UPN, including a Global Administrator. Step 4: They present the SAML token to login.microsoftonline.com and obtain access and refresh tokens for any Microsoft 365 or Azure service. The sign-in log shows authMethod federated and originates from the attacker IP, but the legitimate token-signing certificate makes the assertion cryptographically valid. On-prem to cloud (AAD Connect path). Step 1: The attacker compromises the Entra Connect server (often via SMB lateral movement to a Tier 1 host the admin RDPs to). Step 2: They extract the AD DS connector account password from the ADSync SQL database using AADInternals Get-AADIntSyncCredentials, which decrypts the credentials stored under HKLM:\SOFTWARE\Microsoft\Azure AD Connect using the DPAPI key of the ADSync service account. Step 3: With the MSOL_ password they perform DCSync against any DC and dump krbtgt for forest-wide Golden Ticket capability. Cloud to on-prem (PTA backdoor). Step 1: The attacker compromises a single PTA agent host with local admin. Step 2: They patch the PTA agent DLL in memory using AADInternals Install-AADIntPTASpy to log every plaintext password validated through the agent and to optionally accept any password for any user. Step 3: They harvest plaintext on-prem credentials for any user signing in to Entra ID until the agent restarts. Seamless SSO silver ticket. Step 1: The attacker obtains the NTLM hash of AZUREADSSOACC$ via DCSync or by reading the local SAM on a DC. Step 2: They use AADInternals New-AADIntKerberosTicket or Mimikatz to forge a Kerberos service ticket for HTTP/autologon.microsoftazuread-sso.com with any UPN. Step 3: They present the ticket to login.microsoftonline.com and authenticate as the chosen user, bypassing MFA when conditional access is not enforced on the AZUREADSSOACC sign-in path.
Cómo lo evalúa Guerrilla
Guerrilla detects hybrid identity components through a layered enumeration. It first runs an LDAP query against the default naming context for (sAMAccountName=MSOL_*) and (sAMAccountName=AAD_*) to locate the on-prem connector accounts and reads servicePrincipalName entries to identify the host running ADSync. It then connects to that host over WSMan or remote registry to read HKLM:\SOFTWARE\Microsoft\Azure AD Connect\Shared\InstalledVersion and HKLM:\SOFTWARE\Microsoft\Active Directory Federation Services to confirm the installed product versions. For AD FS, the check queries (objectClass=container)(cn=ADFS) under CN=Microsoft,CN=Program Data and reads thumbnailPhoto and msDS-ManagedPassword for DKM key recoverability. For Seamless SSO, the check binds to (sAMAccountName=AZUREADSSOACC$) and reads pwdLastSet, converting the FILETIME to a UTC datetime and computing age in days. For tenant-side validation, the check uses Microsoft Graph (GET /directoryRoles/{globalAdminId}/members) and inspects each principal for onPremisesSyncEnabled and onPremisesImmutableId; if every Global Administrator has those set, a finding is raised because no cloud-only break-glass identity exists. The PTA agent list is pulled from GET /directory/onPremisesSynchronization or the legacy Get-AzureADPasswordProtectionProxy cmdlet.
Valor recomendado
Azure AD Connect ejecutando la última versión en un servidor dedicado y reforzado. PHS preferible a PTA o federación. SSO transparente deshabilitado si no es necesario. Cuentas de emergencia solo en la nube configuradas
Remediación
Revise la configuración de Azure AD Connect y asegúrese de que se ejecuta en un servidor reforzado de Tier Zero. Evalúe cambiar de la federación o PTA a la sincronización de hash de contraseñas (PHS) para reducir la superficie de ataque. Si utiliza SSO transparente, asegúrese de que la contraseña de la cuenta de equipo AZUREADSSOACC se rota. Verifique que existen cuentas de acceso de emergencia solo en la nube
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | WARN |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- IA-2, AC-20, SC-8
- CIS AD Benchmark
- 3.3.1
- MITRE ATT&CK
- T1078.004, T1649