Black Hat USA 2025 | Advanced Active Directory to Entra ID Lateral Movement Techniques

Why It Matters

A compromised on‑prem AD can instantly grant attackers unrestricted cloud access, bypassing MFA and compromising privileged accounts, leading to data loss and regulatory penalties.

Key Takeaways

• Compromised on‑prem AD enables token‑forging attacks on Entra
• ADFS and Seamless SSO keys allow impersonation of any cloud user
• Soft‑matching can convert cloud‑only admins to vulnerable hybrid accounts
• Sync account can modify conditional‑access and other critical policies
• TPM‑stored service principal keys still exploitable via forged assertions

Summary

The presentation at Black Hat USA 2025 detailed how attackers can move laterally from a fully compromised on‑premises Active Directory into Microsoft Entra ID in hybrid environments. Speaker Dian of Outsider Security explained that once domain‑admin rights are obtained on‑prem, the same trust relationship used for authentication can be abused to gain cloud privileges.

He outlined several configuration‑dependent vectors: ADFS token‑signing certificates, Seamless Single Sign‑On Kerberos keys, and the Entra ID Connect service account. Because Azure AD treats all synchronized users as a single tenant, stealing these keys lets an adversary impersonate any hybrid user, bypass MFA, and even reset passwords across all synced domains. The talk also highlighted that soft‑matching still allows conversion of cloud‑only privileged accounts into hybrid accounts, exposing eligible global admins.

A striking example cited was the ability of the sync account to edit conditional‑access policies via an undocumented internal Graph API, effectively disabling MFA or adding exclusions. Additionally, recent changes to AD Connect that use service‑principal certificates stored in TPM do not prevent abuse; attackers can craft assertions with arbitrary expiry dates, granting long‑term access.

The findings underscore the urgency for enterprises to decommission legacy federation, block soft‑matching, enforce strict MFA that cannot be forged, rotate ADFS and SSO keys, and tightly monitor AD Connect credentials and policy‑change logs. Without these mitigations, a breach of on‑prem AD can quickly translate into full control of the cloud tenant, with severe compliance and financial repercussions.

Original Description

Is there a security boundary between Active Directory and Entra ID in a hybrid environment? The answer to this question, while still somewhat unclear, has changed over the past few years as there has been more hardening of how much "the cloud" trusts data from on-premises. The reason for this is that many threat actors, including APTs, have been making use of known lateral movement techniques to compromise the cloud from AD.

In this talk, we will take a deep dive together into Entra ID and hybrid AD trust internals. We will introduce several new lateral movement techniques that allow us to bypass authentication, MFA and stealthily exfiltrate data using on-premises AD as a starting point, even in environments where the classical techniques didn't work. All these techniques are new, not really vulnerabilities, but part of the design. Several of them have been remediated with recent hardening efforts by Microsoft. Very few of them leave useful logs behind when abused. As you would expect, none of these "features" are documented.

Join me for a wild ride into Entra ID internals, undocumented authentication flows and tenant compromise from on-premises AD.

By:

Dirk-jan Mollema | Security Researcher, Outsider Security

Presentation Materials Available at:

https://blackhat.com/us-25/briefings/schedule/#advanced-active-directory-to-entra-id-lateral-movement-techniques-46500