dirkjanm.io

Most research into Windows Hello focuses on the mechanics in use when authenticating to the local device.

There is a documented enforcement gap in Conditional Access policies that apply to “all resources” but have an exclusion for at least one resource.

While preparing for my Black Hat and DEF CON talks in July of this year, I found the most impactful Entra ID vulnerability that I will probably ever find.

Active Directory Certificate Services (AD CS) attack surface is pretty well explored in Active Directory itself, with *checks notes* already 16 “ESC” attacks being publicly described.

Using applications and service principals for persistence and privilege escalation is a well-known topic in Entra ID (Azure AD).

Temporary Access Passes are a method for Microsoft Entra ID (formerly Azure AD) administrators to configure a temporary password for user accounts, which will also satisfy Multi Factor Authentication controls.

In Microsoft Entra ID (formerly Azure AD, in this blog referred to as “Azure AD”), there are different types of OAuth tokens.

Many modern enterprises operate in a hybrid environment, where Active Directory is used together with Azure Active Directory.

Ever since the initial release of ROADrecon and the ROADtools framework I have been adding new features to it, especially on the authentication side.

A while back, I read an interesting blog by Oddvar Moe about Pre-created computer accounts in Active Directory.