BlackHat Arsenal USA 2024 : Simulating and Exploring Entra ID Attack Paths

BadZure is an open-source PowerShell tool designed for Entra ID (previously known as Azure AD) security analysis. It automates the creation of vulnerable Entra ID tenant environments by utilizing the Microsoft Graph SDK. The tool configures users, groups, and application registrations, then introduces security misconfigurations to simulate attack paths. Aimed at security researchers and practitioners, BadZure facilitates conducting attack simulations, testing defenses, and enhancing the cybersecurity community's understanding of Entra ID attack vectors.

1. #BHUSA   @BlackHatEvents
BadZure : Exploring Azure AD
Attack Paths

Mauricio Velazco
@mvelazco

2. # BHUSA   @BlackHatEvents
●From Arequipa, Peru


●Security Researcher at Microsoft


●@mvelazco


●https://github.com/mvelazc0

#whoami

3. # BHUSA   @BlackHatEvents

●Personal Views: The opinions and views expressed in this presentation are
my own and do not reflect those of my employer.
●Independence: The content presented is based on my personal research
and experience.
●No Endorsement: Mention of specific tools, technologies, or companies
does not imply endorsement by my employer.
●Responsibility: I assume full responsibility for any errors or omissions in
the presentation.

Disclaimer

4. # BHUSA   @BlackHatEvents
Introduction

5. # BHUSA   @BlackHatEvents


Identity:
The Rising Target
created by DALL-E

6. # BHUSA   @BlackHatEvents

7. # BHUSA   @BlackHatEvents

8. # BHUSA   @BlackHatEvents

9. # BHUSA   @BlackHatEvents
Learning list

10. # BHUSA   @BlackHatEvents
Learning list

11. # BHUSA   @BlackHatEvents
Azure Active Directory (Entra ID)
created by DALL-E

●Microsoft's cloud-based identity and access
management service


●The backbone of most of Azure services
like M365


●The natural migration path for traditional
Active Directory orgs

12. # BHUSA   @BlackHatEvents
Challenges in Exploring Azure AD Sec

created by DALL-E

●Learning curve


●Theoretical knowledge vs. practical
experience


●Need for test environments


●Complex setup and configuration

13. # BHUSA   @BlackHatEvents
BadZure
https://github.com/mvelazc0/BadZure

14. # BHUSA   @BlackHatEvents

●Automates Azure AD (Entra ID) tenant
setup by creating users, groups, apps,
service principals and more.

●Randomly assigns groups and
permissions to created principals.

●Creates configurable attack paths to
explore privilege escalation
techniques.


Badzure

15. # BHUSA   @BlackHatEvents
Badzure

●Simulates initial access by employing
common account takeover techniques,
mimicking real-world scenarios

●Simulates privilege escalation by
creating misconfigurations and
allowing users to leverage
compromised accounts to gain
higher-level access within Azure AD

16. # BHUSA   @BlackHatEvents
Badzure

●Offers flexible
configuration through a
YAML file.

17. # BHUSA   @BlackHatEvents
Initial Access

●Password-Based Access: Assigns
random passwords to key user accounts
and generates users.txt for simulating
credential stuffing and password
spraying.

●Token-Based Access: Generates JWT
access tokens for specified principals to
simulate token theft scenarios like
reverse proxy phishing or endpoint
malware.

18. # BHUSA   @BlackHatEvents
PrivEsc: Service Principal Abuse

●Requirements
A user with permissions to modify an app
registration that has privileged access.

●Attack Scenario
Compromised user adds credentials to the
privileged application and authenticates as the
service principal

●Impact
User escalates privileges to the application's
level.




created by DALL-E

19. # BHUSA   @BlackHatEvents
PrivEsc: Service Principal Abuse
https://posts.specterops.io/azure-privilege-escalation-via-service-principal-abuse-210ae2be2a5 by Andy Robbins

20. # BHUSA   @BlackHatEvents
PrivEsc: API Permissions
https://cloudbrothers.info/en/azure-attack-paths/#api-permissions by Fabian Bader

21. # BHUSA   @BlackHatEvents
PrivEsc: Entra Roles
https://cloudbrothers.info/en/azure-attack-paths/#api-permissions by Fabian Bader

22. # BHUSA   @BlackHatEvents
Privilege Escalation: Service Principal
Abuse

23. # BHUSA   @BlackHatEvents
Demo

created by DALL-E

24. # BHUSA   @BlackHatEvents

●Include more Azure resources ( key
vaults, virtual machines, etc)

●Introduce Conditional Access policies

●New initial access: compromised
service principal.

●New attack paths


What’s next

25. # BHUSA   @BlackHatEvents
BadZure
https://github.com/mvelazc0/BadZure

26. # BHUSA   @BlackHatEvents
●Splunk
https://research.splunk.com

●Elastic
https://www.elastic.co/guide/en/security/current/prebuilt-
rules.html

●Sentinel
https://github.com/Azure/Azure-Sentinel

●Sigma
https://github.com/SigmaHQ/sigma



Entra ID Detection
Analytics
created by DALL-E

27. # BHUSA   @BlackHatEvents
●Splunk
https://research.splunk.com

●Elastic
https://www.elastic.co/guide/en/security/current/prebuilt-
rules.html

●Sentinel
https://github.com/Azure/Azure-Sentinel

●Sigma
https://github.com/SigmaHQ/sigma



References
created by DALL-E

28. # BHUSA   @BlackHatEvents
Thank You

29. #BHUSA   @BlackHatEvents
BadZure : Exploring Azure AD
Attack Paths

Mauricio Velazco
@mvelazco