Microsoft Entra ID - Hybrid Brothers

Subscribe

Microsoft Entra ID

A collection of 9 posts

Entra ID Private Access with private integrated storage accounts

Microsoft Entra ID

Entra ID Private Access with private integrated storage accounts

Introduction In the past couple of weeks, I worked on a project where I needed to provide access to a securely private integrated Azure Storage Account via the Entra ID Private access profile. During this project I encountered a very interesting bug, that made me better understand the insights of

Cyber back to school: Microsoft Token Theft Unveiled

Microsoft Entra ID Featured

Cyber back to school: Microsoft Token Theft Unveiled

Introduction I am thrilled to participate in the Cyber Back to School initiative hosted during cyber awareness month! This session is all about Primary Refresh Token VS Access Token stealing in Microsoft Entra ID, and will show the practical countermeasures for each of them. I preferred to write a blog

Client Credentials - Client Certificate

Microsoft Entra ID

Client Credentials - Client Certificate

Introduction The process is quite similar to the client secret flow described here, so be sure to take a look! The challenge here lies in generating a JWT (JSON Web Token) based on a certificate. I will provide a detailed explanation of how the JWT is generated and exchanged for

Client Credentials - Client Secret

Microsoft Entra ID

Client Credentials - Client Secret

Introduction The next authentication flow in my series will be the Client Credentials Flow. Be sure to check out the first one here! We will first take a look at the client secret model. I will skip the basics in this article as this has been explained in my other

T1556.009 - Detect and prevent suspicious conditional access policy modifications

Microsoft Entra ID Featured

T1556.009 - Detect and prevent suspicious conditional access policy modifications

Introduction In April 2024, MITRE came with their new V15 version of ATT&CK. In this version a new sub-technique was introduced called 'T1556.009 - Modify Authentication Process: Conditional Access Policies'. This was, in my opinion, a great addition to the framework, since it is an

Authorization Code Flow

Microsoft Entra ID Featured

Authorization Code Flow

Introduction In the past, I was always curious about the workings of Connect-AzAccount, the authentication command from the Az.Accounts PowerShell module. This led me to delve into debugging, and the subsequent article is a product of that exploration. It's intriguing that both Az CLI and Az PowerShell

Using WDAC to ingest missing MDE events and detect token stealing

Microsoft Entra ID

Using WDAC to ingest missing MDE events and detect token stealing

Introduction In a previous blog post I talked about how adversaries can exploit SSO capabilities of Hybrid or fully Entra ID joined devices. I mentioned the different ways we can steal tokens from the devices, either by using BrowserCore.exe or MicrosoftAccountTokenProvider.dll. Here I concluded that exploiting BrowserCore.exe

From hybrid / fully joined devices to Entra ID

Microsoft Entra ID

From hybrid / fully joined devices to Entra ID

Introduction Adversaries are more and more interested in the data and infrastructure that lives in Cloud environments like Azure and Microsoft 365 solutions. Since Microsoft EntraID is the most common central IDP solution for these environments, it is important to identify the possible paths attackers can use to move from

Using Managed Identities in Logic App HTTP triggers

Microsoft Entra ID

Using Managed Identities in Logic App HTTP triggers

Introduction During the past few months, I have been assessing the security configurations of applications created in Azure. During these assessments, I found that people like to use Logic Apps and HTTP triggers to create simple APIs or integration flows. Often these HTTP triggers are being called by other Azure