Cyber Solutions Fest Fall: Identity Threats & Zero Trust

Most organizations run Active Directory and Entra ID as one identity system, but they defend them as two. Attackers take advantage of that gap. A foothold on-prem can become Global Admin in the cloud, and a compromised cloud identity can come back down to a domain controller.

This session walks through the attack paths that cross the sync boundary in both directions. Going up, we’ll cover abusing the Entra Connect sync account, hard- and soft-match account takeover, PTA agent compromise, and forging tickets with the Seamless SSO AZUREADSSOACC$Expand key. Coming back down, we’ll look at how Cloud Kerberos Trust and Entra-issued partial TGTs give a cloud attacker a path into on-prem resources.

Each technique leaves evidence, but rarely in one place. Some of it shows up in AD changes, some in Kerberos events, and some in Entra audit and sign-in logs. We’ll show what each step looks like in each plane and why correlating them is what turns scattered low-severity events into a detectable attack chain.

Attendees will leave with:

• A map of hybrid trust relationships that need the same protection as tier 0
• Specific events and signals to monitor on both sides of the sync boundary
• Hardening steps for Entra Connect, PTA agents, and Seamless SSO that can be done this quarter