From the cloud to the internal network - Offense vs Defense by Snir Ben-Shimol, Varonis

### Overview In this talk, Snir Ben-Shimol, Director of Cybersecurity at Varonis, examines the evolving threat landscape as organizations migrate from on-premises Active Directory environments to hybrid and public cloud infrastructures (focusing heavily on Microsoft Azure and Office 365). Emphasizing the "assume breach" mindset, he explains that while perimeter controls inevitably fail, defense hinges on internal architecture, identity governance, and monitoring. He contrasts on-premise Active Directory concepts with Azure AD, breaks down attacker techniques across hybrid identities, and outlines detection and monitoring strategies for security operations center (SOC) and blue teams.

### Key Topics - **Hybrid Cloud Identity Architecture:** Moving from on-prem Active Directory to Azure AD introduces fundamental differences in administration, permissions, service principals, subscriptions, and tenants. Trying to lift and shift on-prem policy mindsets into Azure AD creates substantial security gaps. - **DevOps and Privileged Cloud Access:** DevOps users frequently receive broad subscription-level administrative privileges, functioning like modern domain administrators. Their credentials, access tokens, and access points are prime targets for initial compromise and privilege escalation. - **Synchronization and Federation Risks:** Azure AD Connect utilizes highly privileged service accounts that replicate data and password hashes between on-prem and the cloud, presenting severe risks such as DCSync abuse. Similarly, Active Directory Federation Services (ADFS)DMZ servers host critical signing certificates; compromising these allows authentication into Azure AD. - **MFA Limitations and Gaps:** Multi-Factor Authentication is an essential layer, but not a silver bullet. Highly privileged "break-glass" emergency access accounts are often explicitly configured without MFA per vendor recommendations. Additionally, legacy services, MSPs, and service accounts often lack MFA, while real-world adversary-in-the-middle phishing can intercept MFA tokens. - **Reconnaissance via DNS:** Attackers favor DNS reconnaissance over Active Directory/LDAP queries to avoid triggering heavily monitored detection systems. Reverse lookups (PTR queries) allow mapping of network segmentation, servers, and hostnames while remaining disguised inside ordinary network traffic. - **Cloud Data Sharing and Collaboration:** Features in SharePoint Online and Microsoft Teams permit direct or external file sharing that bypasses standard folder-level permissions, complicating access governance unless carefully audited and restricted.

### Technical Details - **Azure AD Connect & DCSync:** Default or misconfigured permissions on Azure AD Connect synchronization service accounts can permit directory replication actions (DCSync), enabling attackers to harvest password hashes across the domain without being a full Domain Admin. - **DNS Reconnaissance Detection:** Blue teams should monitor PTR queries (reverse DNS lookups) within internal subnets. Detection logic can filter out false positives by inspecting DNS authoritative flags and distinguishing internal queries from upstream queries sent outside the enterprise boundary, while accounting for multi-tier DNS forwarding. - **Phishing & Credential Interception:** Attackers utilize Office 365/SharePoint Online brand impersonation, Punycode domain spoofing, and real-time phishing kits that request both passwords and live MFA tokens simultaneously to establish authenticated sessions. - **Cloud Graph Auditing:** Blue teams can query the Azure AD Graph API to audit permission changes, monitor file-sharing events in SharePoint Online, and identify anomalous account delegations. - **Insider Threat Case Study:** The speaker reviewed an incident where an 8-year IT administrator created an unprivileged shadow user account, granted it delegate access to executive mailboxes (CFO, Procurement, HR, team members), rapidly read dozens of emails across those accounts, accessed network shares containing salary spreadsheets, and exfiltrated zipped archives to a personal Gmail account.

### Takeaways - **Assume Breach:** Security teams must focus on internal controls, least-privilege role assignment, and rapid anomaly detection rather than relying exclusively on boundary defenses or perimeter sandboxes. - **Audit Non-MFA Accounts:** Organizations must systematically map and tightly monitor all accounts exempt from MFA, such as emergency access accounts, MSP accounts, and legacy service principals. - **Lock Down Cloud Sharing:** Proactively disable global external file sharing in SharePoint Online/Teams where possible, enforce role-based access, and leverage file classification to alert on sensitive data exposure. - **Behavioral Telemetry:** Correlating proxy upload logs, file activity, DNS query anomalies, and mailbox delegation changes provides early detection for both external adversaries and insider threats.