Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

SyncJacking: Hard Matching Vulnerability Enables Entra ID Account Takeover

semperis.com | vulnerability | High | #attack-chains | #account-takeover | #identity-security | #entra-id | #semperis | #entra-connect | #syncjacking | #hybrid-identity

Summary

SyncJacking: how attackers can abuse Entra Connect hard matching to take over synchronized Entra ID accounts, including Active Global Administrators — and how to detect and mitigate it.
Published
Collected

original ↗

Related coverage

blog · semperis.com
How to Redefine Cyber Resilience: Start by Rethinking Hybrid Identity Protection
Semperis argues AI-driven attacks are outpacing identity teams as machine identities outnumber human ones 10:1, and urges building organization-wide cyber resilience around hybrid identity protection before the next crisis.
blog · semperis.com
Introducing Migrator 2.0: Move Active Directory with Confidence
Semperis introduces Migrator for Active Directory 2.0, an update aimed at helping organizations move Active Directory environments with confidence and greater operational control.
research · semperis.com
EntraGoat Scenario 6: Exploiting Certificate-Based Authentication to Impersonate Global Admin in Entra ID
EntraGoat Scenario 6: chaining leaked service principal credentials, over-permissive app roles and certificate-based authentication to upload a rogue root CA and impersonate Global Admin.
blog · semperis.com
Microsoft Entra Connect Compromise Explained
If attackers seize the Entra Connect server, the ADSync account and PTA agents open a path from on-prem AD to the cloud. The post shows AADInternals-based credential theft and hardening tips.
blog · semperis.com
MFA for Active Directory: An Overview
MFA for AD is challenging: native support is smartcards only, so organizations layer Windows Hello for Business or Duo on endpoints. Covers on-prem and hybrid options including Entra Connect.
blog · semperis.com
4 Reasons to Increase Recoverability of Entra ID Resources
Four reasons to improve Entra ID recoverability: widespread misconfigurations, the recycle bin's limited 30-day protection, hard-deleted objects like service principals, and hybrid attack-path gaps.
back