From On-Prem to the Cloud: Hybrid AD Attack Path
Sergey Chubarov demonstrates live attack scenarios bridging on-premises Active Directory and Azure AD, exploiting synchronization flaws to compromise hybrid clouds.
Summary
The Security Realities of Hybrid Active Directory
Most modern enterprises operate hybrid identity architectures, relying on synchronization engines to bridge on-premises Active Directory with Microsoft Entra ID (Azure AD).
Mapping Hybrid Lateral Movement Pathways
Sergey Chubarov demonstrates live attack scenarios illustrating how compromising an on-premises workstation or server allows pivoting into cloud identities.
Exploiting Azure AD Connect and Seamless SSO
Chubarov dissects synchronization vulnerabilities, password hash sync extraction, and OAuth consent grant abuse to escalate privileges to Global Administrator.
Hardening Hybrid Identity Deployments
The author provides identity administrators with actionable hardening configurations to isolate tier-0 synchronization servers and implement cloud conditional access.
Related talks
Main Stage·44 min
Sean Metcalf
Active Directory expert Sean Metcalf reveals attack paths bridging on-premises Windows networks and Azure Active Directory in hybrid enterprise clouds.
Main Stage·34 min
Sean Metcalf
Sean Metcalf answers audience questions regarding Active Directory Federation Services, Azure AD Connect security, and hybrid identity hardening.
BSides Edmonton 2025·48 min
Ian Lin · Chance Pearson
Analysts investigate attack surfaces and defenses concerning Trust Boundary Theater: Lateral Movement in the Age of Hybrid Cloud by Ian Lin, Chance Pearson.