Hybrid Active Directory Attacks: Anatomy and Defenses
summary
Slides show concrete AD attack paths: privileged users with SPNs exploitable in hours, unconstrained Kerberos delegation, PrimaryGroupID misuse, SIDHistory backdoors, and adminSDHolder ACL poisoning (SDPROP runs every 60 minutes). Azure risks include guest invite settings, Azure AD Connect sync accounts that can dump on‑prem password hashes and perform DCSync, and the mitigation steps include run these PowerShell commands, use the ADSyncConfig module, and review adminSDHolder runs every 60 minutes.
AI-written summary · about
chapters (20)
- 0:00Introduction to hybrid AD attacks
- 3:10Realities of AD and Azure AD
- 6:03Attacker strategy in hybrid environments
- 8:58Myths about PAM and MFA
- 9:19On-prem AD attack vectors
- 11:53Unconstrained Kerberos delegation risks
- 15:29Enumeration without privileges
- 16:54Service accounts security gaps
- 19:44Primary group ID vulnerabilities
- 23:07Fixing legacy AD configurations
- 25:14SIDHistory and persistence
- 28:54AdminSDHolder explained
- 34:53Shadow admins and hidden privileges
- 36:42Azure AD guest account risks
- 39:55Azure AD default security flaws
- 40:56Azure AD Connect high-risk accounts
- 43:53AD Cloud Sync benefits
- 45:20Conditional Access policy pitfalls
- 47:53Security defaults and MFA
- 48:37Tier 0 principals protection
related talks
40mTop Active Directory Attacks: Understand, then Prevent and Detect
55mOffensive Azure Security
40mWhat’s Old is New: Hybrid Security for Microsoft Azure and On-Premises Tech
37mThreat Hunting in Active Directory Environment
50mBeyond the Mcse: Active Directory for the Security Professional
53mThe Importance of Identity-Centric Security in 2024
50mAttacking and Defending the Microsoft Cloud (Office 365 & Azure AD)
51mAdvanced Attack Vectors in Azure Environments