Azure Active Directory Hacking Wars
Batuhan Sancak demonstrates advanced attack techniques targeting Azure Active Directory, including Primary Refresh Token (PRT) theft and OAuth abuse.
Summary
The Ubiquity of Azure Active Directory in Enterprise Identity
With over 15 million enterprise tenants and adoption across 95% of Fortune 500 companies, Microsoft Entra ID (Azure AD) is the primary target for identity-driven attacks.
Extracting Primary Refresh Tokens (PRT) for Seamless Auth
Batuhan Sancak demonstrates extracting Azure AD Primary Refresh Tokens (PRTs) from memory and TPM-backed device registrations to bypass multi-factor authentication.
Abusing Service Principals and Illicit Consent Grants
Sancak walks through compromising high-privilege service principals, injecting malicious OAuth app credentials, and moving laterally across linked Microsoft 365 tenants.
Defending Azure AD Identity Environments
The author outlines conditional access policies, continuous access evaluation (CAE), and Azure AD Identity Protection monitoring to intercept credential replay attacks.
Related talks
Cloud Village·23 min
Nevada · Kam
Evolving SquarePhish to weaponize QR codes for Entra ID Primary Refresh Token extraction.
TROOPERS IT Security Conference·42 min
Security researchers examine technical aspects of Azure AD cloud native CBA - use your smartcards in the cloud.
Adversary Village·34 min
Sergey Chubarov
Sergey Chubarov demonstrates live attack scenarios bridging on-premises Active Directory and Azure AD, exploiting synchronization flaws to compromise hybrid clouds.