Attacking and Defending the Microsoft Cloud (Office 365 & Azure AD)

## Overview

Presented at Black Hat by Sean Metcalf (Founder of Trimark Security) and Mark Morowczynski (Principal Program Manager, Microsoft Identity Division), this session examines attack surfaces and defense strategies when integrating on-premises Active Directory with Office 365 and Azure Active Directory (Azure AD). Using a hypothetical enterprise scenario—Acme, an organization with 500,000 employees across 140 countries migrating to Office 365 and deploying Azure MFA—the speakers demonstrate how cloud adoption often stalls over niche edge cases while leaving critical hybrid identity components exposed to reconnaissance and exploitation.

## External Reconnaissance via DNS and Federation Discovery

An attacker begins by profiling an organization without generating internal network noise: - **MX Records:** Scanning mail exchanger records (evaluated across Fortune 1000 targets) exposes email filtering vendors (e.g., Proofpoint, Cisco, Office 365), allowing adversaries to tailor phishing payloads against matching defenses. - **DNS TXT Records:** Third-party domain/site verification records frequently linger indefinitely in public DNS, revealing adoption of SaaS platforms such as Atlassian, Cisco, Citrix, Dropbox, and WebEx. Attackers exploit these insights to craft targeted lures (e.g., urgent WebEx updates) or identify vulnerable associated platforms (such as misconfigured Atlassian JIRA instances). - **Federation Fingerprinting:** Attackers enumerate standard host prefixes (`FS`, `SSO`, `STS`) to locate Active Directory Federation Services (AD FS) endpoints and determine how authentication flows are structured.

## Compromising Hybrid Identity Infrastructure

The talk details high-impact techniques targeting hybrid identity mechanisms: - **AD FS Token Forgery ("Golden SAML"):** Stealing the token-signing certificate from an AD FS server enables an attacker to forge SAML tokens and access any federated cloud service (e.g., Salesforce, Workday) under arbitrary user identities. Tools like `ADFSpoof` (developed by Doug Bienstock and Austin) automate extracting certificate data and generating forged tokens. - **Malicious AD FS Adapters:** Third-party MFA integrations (such as Duo Security) utilize custom DLL adapters in AD FS. Attackers can decompile and alter the adapter's code to intercept authentication flows and execute arbitrary commands (such as malicious PowerShell scripts) whenever users log in. - **Azure AD Connect Exploitation:** Express installations of Azure AD Connect configure password hash synchronization (syncing a hash of the hash). The process creates an `MSOL` service account and populates installation host details directly into the account's description field. - **Privilege Escalation via AD ACLs:** Tools like PowerView (`Invoke-ACLScanner`, `Find-GPOComputerAdmin`) can locate `MSOL` accounts with directory replication permissions (`DS-Replication-Get-Changes` and `DS-Replication-Get-Changes-All`—the same permissions used in Mimikatz DCSync attacks). Attackers can then audit GPO delegations (such as finding delegated modify rights assigned to lower-tier server admin groups) to compromise the Azure AD Connect host, manipulate local administrative groups, and pivot to domain-level access.

## Defense and Operational Takeaways

- **Treat Hybrid Identity as Tier 0:** Systems like AD FS and Azure AD Connect hold administrative power equivalent to domain controllers. Compromise of an Azure AD Connect server or its delegating GPOs leads directly to total domain compromise. - **Secure and Rotate Certificates:** Protect AD FS token-signing certificates rigorously, restricting local administrative access to federation hosts. - **Centralize Identity Telemetry:** Ingest and correlate logs from on-premises Active Directory, AD FS, and Azure AD into a centralized SIEM to detect suspicious token requests and administrative anomalies. - **DNS Hygiene:** Routinely clean up domain verification TXT records after SaaS onboarding is complete to prevent external recon of the enterprise tech stack.