When an attacker gains a foothold on a Windows workstation joined to an Active Directory domain, the intrusion rarely stops there. If the organisation runs Microsoft 365 with identity synchronisation enabled, that single endpoint becomes the opening of a corridor leading straight into the cloud. The hybrid attack chain this creates is one of the most effective threats facing organisations today, largely because it crosses a boundary that many security teams still monitor as two separate problems rather than one.
Initial access: compromising the Active Directory workstation
Entry points tend to be mundane. A well-crafted phishing email, a macro-laced document, or an unpatched service listening on the network are all common starting points. The attacker lands with standard user privileges on a domain-joined machine. That is enough to get started.
The first order of business is establishing quiet persistence and escalating local privileges. Misconfigured services running under privileged accounts, impersonatable tokens, and unquoted service paths are classic targets. Once local administrator rights are secured, the attack surface on that host opens up entirely.
Harvesting local secrets: LSASS and DPAPI
Credential collection begins in earnest at this stage. Two targets are consistently prioritised on a compromised Windows endpoint.
LSASS: the memory that remembers everything
The LSASS process holds active session credentials in memory. Dumping it through techniques such as abusing MiniDumpWriteDump or using signed, legitimate drivers yields NTLM hashes, Kerberos tickets, and sometimes cleartext passwords if WDigest authentication is still enabled. Modern post-exploitation frameworks handle this in a matter of seconds.
DPAPI: the silent vault
DPAPI (Data Protection API) is Windows' built-in mechanism for encrypting local secrets: browser-saved passwords, Windows Credential Manager entries, private certificate keys. These are protected by master keys derived from the user's password. With local administrator access and the user's NTLM hash, an attacker can decrypt every DPAPI blob on the machine. This vector consistently flies under the radar in traditional security reviews because it leaves no obvious trace in standard logs.
Moving toward domain controllers
With valid credentials in hand, the attacker pivots laterally. Pass-the-Hash and Pass-the-Ticket techniques allow authentication against other machines without ever knowing the plaintext password. The goal is to reach a domain controller or, ideally, the server running Azure AD Connect.
In many environments, Azure AD Connect runs on a domain-member server with broad permissions. It is a prime target for two reasons: the service account can trigger DRS replication to retrieve all domain password hashes, and the server locally stores the credentials of the cloud synchronisation account.
Breaking into Microsoft 365 and Entra ID
This is where the on-premises and cloud boundary dissolves entirely. Several paths lead from a compromised domain to a Microsoft 365 tenant.
Stealing session tokens and refresh tokens
On any workstation where the user is signed into Microsoft 365 services, OAuth refresh tokens are cached locally in browser profiles and application stores like Teams or OneDrive. Extracting these tokens enables the attacker to generate valid access tokens indefinitely, without triggering a password prompt. Critically, changing the user's password does not invalidate refresh tokens; only explicit revocation in Entra ID does.
Abusing Azure AD Connect synchronisation
Compromising the Azure AD Connect server gives the attacker access to the MSOL synchronisation account credentials. That account carries enough privilege to run a DCSync attack against the domain and to authenticate directly into the Entra ID tenant with elevated rights. From there, creating new cloud accounts, modifying Conditional Access policies, or adding credentials to managed applications is entirely within reach. The tenant is fully open.
Security teams looking to test this scenario in a safe, controlled setting can explore the hybrid attack labs in the CyberAct catalogue, which reproduce each step with full telemetry visibility.
AD and the cloud are one security perimeter
This attack chain makes one point impossible to ignore: your Microsoft 365 tenant is not separate from your on-premises infrastructure. Identity synchronisation, designed to simplify user experience, creates a permanent bridge between the two environments. Compromise one, and you effectively compromise both.
Detection strategy has to reflect this. Monitoring LSASS through an EDR without correlating it against cloud authentication anomalies means watching half the picture. An exfiltrated refresh token leaves no trace in Active Directory logs whatsoever. Catching it requires correlating Entra ID Sign-in logs, Microsoft Defender for Identity alerts, and Windows event data in a unified view.
SOC teams that have not yet built this cross-environment correlation can use a cyber maturity diagnostic to map exactly where their detection coverage has blind spots.
Concrete countermeasures exist at every stage: disabling WDigest, enabling Credential Guard to protect LSASS, enforcing Conditional Access with continuous access evaluation, rotating Azure AD Connect synchronisation credentials regularly, and tiering administrative accounts so no single compromised identity has domain-wide reach. None of these alone closes every door. Applied together, they raise the cost of each step in this chain to a point where most attackers will either be detected or forced to abandon.
Frequently asked questions
What is DPAPI and why does it matter in a compromise scenario?
DPAPI is the Windows subsystem that encrypts local secrets such as browser-saved passwords and Credential Manager entries. An attacker with local administrator access and the user's NTLM hash can decrypt every DPAPI-protected blob on the machine, extracting credentials that may unlock additional systems or cloud services. It is a high-value target that standard security reviews frequently overlook.
How can an attacker access Microsoft 365 from a compromised workstation without knowing the user's cloud password?
By extracting OAuth refresh tokens cached locally in browser profiles or application stores like Teams. These tokens allow the attacker to silently generate valid access tokens without any re-authentication, and they remain usable even after a password reset unless explicitly revoked in Entra ID.
What role does Azure AD Connect play in this attack chain?
Azure AD Connect synchronises identities between on-premises Active Directory and Entra ID. Compromising the server that hosts it gives an attacker access to the synchronisation account, which has sufficient rights to perform a DCSync attack on the domain and authenticate into the cloud tenant with elevated privileges, effectively granting full control over the Microsoft 365 environment.
How should detection be structured to cover both AD and cloud?
By aggregating Windows authentication events, LSASS access logs, and DRS replication activity alongside Entra ID Sign-in logs and Defender for Identity alerts in a single SIEM. The key signal is temporal correlation: an on-premises anomaly followed within minutes by an unusual cloud sign-in is often the clearest indicator of a hybrid attack in progress.