offensive-active-directory

# Hybrid Identity — Offensive Testing Methodology ## When to Use - When performing red team assessments of Azure environments linked to on-premises AD. - When validating the security of AAD Connect servers and federation infrastructure (AD FS). - When investigating identity-based lateral movement from on-prem to cloud. - When assessing the impact of on-premises compromise on Azure resources. ## Key Concepts | Term | Definition | |------|------------| | AAD Connect | Tool used to sync on-premises AD objects to Azure Entra ID | | Golden SAML | Attack where a stolen token-signing certificate is used to forge SAML assertions | | DCSync | Technique used to replicate password hashes from a Domain Controller | | Pass-the-PRT | Using a stolen Primary Refresh Token to hijack an Azure session | ## Offensive Pivot Points ### 1. AAD Connect Server The AAD Connect server stores credentials for the `MSOL_` account, which can be abused for DCSync. ### 2. ADFS Golden SAML Compromising the ADFS server allows for the extraction of the private key used for token signing, enabling unlimited session forgery. ### 3. Primary Refresh Token (PRT) The PRT is the "gold" token in Entra ID. Stealing it from a joined device allows for session hijacking that bypasses MFA. ## Remediation Reference - **Harden AAD Connect**: Restrict physical and network access to the AAD Connect server. - **Use Phishing-Resistant MFA**: Deploy FIDO2 or Certificate-Based Auth to mitigate session theft. - **Monitor for DCSync**: Use Microsoft Defender for Identity (MDI) to detect unusual replication requests.