Thread by @_wald0

Users in Azure deserve attention from attackers and defenders. But Service Principals deserve as much attention, and actually maybe deserve much more attention than users. A quick thread on why, and resources for attackers and defenders:

First, the password reset system in Azure has tiered administration baked into it. Only your T0 users can reset T0 users' passwords:

https://twitter.com/_wald0/status/1493263809074503682

That system is amazingly effective at preventing the existence of password reset based attack paths.

But attack paths involving adding new service principal credentials can and do emerge.

And nowhere are those attack paths more difficult to audit than when they involve MIs

MIs are managed identities - a way for an Azure resource to authenticate to other Azure services, without needing to know any passwords.

Say for example you want to run a VM in Azure. Your initial setup will look like this:

The subscription has a trust relationship with AzureAD. But unlike vanilla on-prem AD, this trust relationship does NOT restrict direction of access.

Now let's establish a managed identity for the VM, so the VM itself can access Azure resources:

So far so good, we haven't introduced any dangerous configurations yet.

Now let's introduce a user into the mix, and we'll give that user control of the Resource Group above the VM:

Because role assignments always inherit down to all descendent objects in Azure, the User gains control not only of the resource group, but also of the VM.

And because the User controls the VM, an attack path (in red) has emerge connecting the User to the Service Principal:

Two disparate, seemingly unconnected configurations have created an attack path that may lead to escalation of privilege. This is classic "list-based" versus "graph-based" thinking.

Here's what defenders should do about this:

First, understand that any managed identity assignment can turn an Azure resource (like a VM) into a Tier Zero object, if the Service Principal is Tier Zero. And because Azure role assignments inherit down, that makes the ENTIRE subscription Tier Zero:

https://twitter.com/_wald0/status/1454158634070339586

Second, read this guidance from @inversecos on detecting malicious backdoors around automation accounts, which themselves revolve around service principals: inversecos.com/2021/12/how-to…

Third: if you have a P2 license, use Microsoft's access review feature to keep track of dangerous role assignments being granted to service principals: docs.microsoft.com/en-us/azure/ac…

Finally, consider joining me on this webinar next week, where I will show you how #BloodHoundEnterprise brings Attack Path Management to Azure: specterops.zoom.us/webinar/regist…

I will also introduce and demonstrate two new abuse primitives in Azure which abuse managed identities.