Lateral Movement in the Age of Hybrid Cloud
summary
Concrete attack paths, working tools, and specific misconfigs decide what to watch: live demos of device code fishing and evil gen X phishing that steal cookies and MFA tokens, road recon enumeration of conditional access, MSBuild-based binary drops on Azure VMs to run as SYSTEM, and Seamless SSO/DCsync abuse to swap on‑prem hashes into Entra ID and request PIM to become Global Admin. Detections tested: Defender for Cloud gaps, token broker caches, and why directory readwriteall and default device registration routinely break defenses.
AI-written summary · about
chapters (9)
- 0:00Hybrid cloud lateral movement
- 8:25Conditional access bypasses
- 14:44Cloud to on-prem pivoting
- 28:06On-prem to cloud trust exploits
- 35:30Privilege escalation via PIM/SSO
- 39:41Token theft from Microsoft processes
- 40:03Defender gotchas and blue team tips
- 44:57Microsoft security shortcomings
- 46:43Q&A
related talks
40mWhat’s Old is New: Hybrid Security for Microsoft Azure and On-Premises Tech
55mAzure Attacks Unpacked: Real-World Threats & Lessons
40mFighting Where They Aren't: How Attackers Avoid Endpoints in Modern Attacks
56mHack the Cloud Hack the Company: the Cloud Impact on Enterprise Security
51mAdvanced Attack Vectors in Azure Environments
43mClouds in the forecast: CrowdStrike cloud risk report
41mUncovering Azure's Silent Threats: A Journey into Cloud Vulnerabilities
48mHacking Exposed: Next-Generation Tactics, Techniques, and Procedures