Cyber Defense eMagazine March Edition for 2022

systems to manage identity and access: Azure Active Directory, Azure Resource Manager, and the Azure
API Apps permissions system. Unfortunately, these systems can often conflict and make it unclear which
system is the source of truth. This makes it more difficult for security teams to audit who has access to
valuable systems, which in turn makes it harder for them to find and close down Attack Paths.
The more difficult it is to assign permissions, the more likely that Cloud or AD engineers will give blanket
permissions to large groups of users or give a problem user admin access to just make everything work.
After all, their main task is to ensure employees have access to the systems they need to do their jobs.
This complexity creates additional attack paths and undermines the expertise of security and Identity
Access Management engineers.
4. Attacks can move from Azure to on-prem AD
Attack Paths in AD don’t just stay on-premise or in the cloud; they can cross between environments. For
example, adversaries can move laterally from on-premise AD to Azure AD, escalate privilege within
Azure, and then move back from Azure to on-premise. They can do this by abusing Microsoft Endpoint
Manager to move laterally from an Azure tenant to an on-prem AD domain. This abuse becomes possible
when Windows devices have been Hybrid-Joined to both the Azure tenant and the on-prem Active
Directory domain. This attack can be carried out by Azure tenant authenticated user — no special
privileges or roles needed. Abusing one of the three endpoint management systems to execute
PowerShell scripts on hybrid-joined devices requires either the “Global Admin” or “Intune Administrator”
roles. This is why it’s vital to protect Active Directory both on-premises and in the cloud - because both
of them give attackers a way in.
5. Attack Paths open orgs up to dangerous attacks like ransomware
Attack Paths are a way for adversaries to get powerful access that lets them steal sensitive data, deploy
ransomware or other malware, achieve persistence in the network or add backdoors that will allow them
to instantly re-gain privileged access in the future. An adversary that is well versed in attacking AD (and
most adversaries are) can gain privileges and move freely across Attack Paths leaving minimal risk of
discovery from defenders, achieve persistence, and gain the keys to the kingdom. Ransomware is a
particularly active threat at the moment; approximately 37% of global organizations said they were the
victim of some form of ransomware attack in 2021, according to IDC's "2021 Ransomware Study." The
FBI's Internet Crime Complaint Center received 62% more ransomware reports year-over-year in the first
half of 2021. To reduce their vulnerability to all these attacks and stop problems like ransomware at their
source, organizations should work on eliminating the Attack Paths in their AD environment.
Identity and access management on-premises and in the cloud are two sides of the same coin.
Organizations with a hybrid infrastructure model must protect both in order to keep their users and data
safe.
Cyber Defense eMagazine – March 2022 Edition 69
Copyright © 2022, Cyber Defense Magazine. All rights reserved worldwide.