@Secureworks just released a threat analysis regarding flaws our team found in #AzureAD Pass-through Authentication (PTA).
secureworks.com/research/azure…
The flaws allow threat actors to:
* Gather credentials
* Login with invalid credentials
* Conduct DoS attacks
1/3
secureworks.com/research/azure…
The flaws allow threat actors to:
* Gather credentials
* Login with invalid credentials
* Conduct DoS attacks
1/3
How is this different from previous PTA exploits like #AADInternals PTASpy?
* After the initial compromise of a PTA agent, the exploitation is remote
* Exploitation can't be detected from the Azure portal or logs
* Exploit is persistent
2/3
* After the initial compromise of a PTA agent, the exploitation is remote
* Exploitation can't be detected from the Azure portal or logs
* Exploit is persistent
2/3
What can administrators do if they detect a compromised PTA agent?
* Contact Microsoft support to remove the agent
How to protect / prevent?
* Treat all servers with PTA agent as Tier 0
3/3
* Contact Microsoft support to remove the agent
How to protect / prevent?
* Treat all servers with PTA agent as Tier 0
3/3
• • •
Missing some Tweet in this thread? You can try to
force a refresh
