Hybrid Identity: Attacks on AD & Azure AD

Hybrid Identity refers to architectures where on-premises Active Directory (AD) and Azure Active Directory (Azure AD) are linked to provide unified authentication across both environments. The core components enabling this link are Azure AD Connect, AD FS, and Pass-Through Authentication (PTA). Azure AD Connect synchronizes identity objects, password hashes, and attributes between both directories. This synchronization process creates a shared identity plane that spans two fundamentally different trust boundaries: the corporate network and a cloud tenant. In cybersecurity, Hybrid Identity is critical because a compromise in one environment can propagate directly into the other. An attacker who gains sufficient privileges on-premises can abuse sync mechanisms to escalate into the cloud tenant, and vice versa. The attack surface is therefore not the sum of two independent environments. It is a single, extended surface where the weakest boundary determines the overall exposure. Misconfigurations in sync scope, overprivileged sync accounts, and token trust relationships are the primary sources of exploitable weaknesses in Hybrid Identity deployments.

Detecting attacks against Hybrid Identity requires monitoring across both on-premises and cloud log sources simultaneously. On the Azure AD side, the Azure AD Sign-In Logs and Audit Logs surface suspicious events such as unexpected token issuances, sign-ins from the AZUREADSSOACC$ machine account, and unusual modifications to directory sync settings. The Azure AD Connect service account, typically named MSOL_xxxxxxxx, should never perform interactive logins. Any interactive sign-in from this account is a high-confidence indicator of compromise. On-premises, monitor Windows Event ID 4624 (logon) and 4648 (explicit credential use) for the sync service account. Event ID 4662 records access to sensitive AD objects and should be enabled on the directory service access audit policy. Changes to the msDS-KeyCredentialLink attribute signal potential Shadow Credentials attacks. In the AD FS infrastructure, event IDs 1202 and 1200 in the AD FS event log record issued tokens. A sudden spike in successful token issuances for privileged accounts, especially outside business hours, warrants immediate investigation. Microsoft Sentinel's Hybrid Identity workbook and Defender for Identity alerts on DCSync and credential dumping complement these log sources.

Red Teams targeting Hybrid Identity focus on breaking the trust boundary between on-premises AD and Azure AD. The highest-impact technique is abusing the Azure AD Connect sync account. If an attacker compromises a domain controller or the server running Azure AD Connect, tools such as AADInternals can extract the credentials of the MSOL sync account and the configuration database. With these credentials, an attacker can trigger a full directory sync, modify cloud-side attributes, or reset any non-federated user's password hash in Azure AD. A second critical vector targets AD FS. Golden SAML attacks forge SAML assertions by extracting the AD FS token-signing certificate using the ADFSDump tool. The forged assertion is accepted by Azure AD and any relying party trusting that federation. Pass-Through Authentication agents represent a third vector: a compromised PTA agent can intercept plaintext credentials during the authentication callback. Hardening measures include isolating the Azure AD Connect server as a Tier 0 asset, enabling Azure AD Privileged Identity Management for cloud admin roles, restricting the sync scope to exclude privileged AD groups, and rotating AD FS token-signing certificates regularly. MFA enforcement on all cloud admin accounts must not rely solely on on-premises controls.