DEF CON 33: NetSPI’s “Access Everywhere” Experience

NetSPI's DEF CON 33 talk shows how Azure resources supporting Entra ID authentication expose tenant IDs, letting attackers map cloud resources back to specific organizations at scale.

Explains how Microsoft LAPS stores local admin passwords in LDAP, and how incorrect delegation on ms-MCS-AdmPwd can expose cleartext credentials that aid lateral movement.

Details five ways to find systems running Domain Admin processes: checking locally, querying domain controllers for sessions, scanning remote tasks, NetBIOS enumeration, and token spraying.

Syncing Domain Admins into Entra ID lets attackers pivot from compromised on-prem AD to the cloud, and back via password writeback. CIS and Microsoft advise keeping privileged admin accounts cloud-only.

SpecterOps argues identity risk now extends beyond Tier Zero, as attackers increasingly use legitimate credentials and trusted relationships to reach backups, regulated data, and other critical workloads.

NetSPI agents recap DEF CON 32: six zero-days found in ATM disk encryption software, General Paul Nakasone on US cyber strategy, and proactive security lessons from talks and workshops.