Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Abusing Entra ID Misconfigurations to Bypass MFA

netspi.com | blog | #identity-security | #entra-id | #mfa-bypass | #conditional-access | #azure-ad | #duo

Summary

NetSPI describes an MFA bypass found in an external assessment: an Entra ID Conditional Access misconfiguration with Duo let attackers reuse an SSO token without any MFA prompt.
Published
Collected

original ↗

Related coverage

blog · projectblack.io
Should I Azure AD Sync/Entra Cloud Sync Domain Admins?
Syncing Domain Admins into Entra ID lets attackers pivot from compromised on-prem AD to the cloud, and back via password writeback. CIS and Microsoft advise keeping privileged admin accounts cloud-only.
blog · wiz.io
How to Spot and Stop Rogue Device Joins
Nearly one in seven Entra ID environments saw rogue device registrations in 90 days, Wiz finds; attackers abuse DRS via device-code phishing, and AI-realistic device names erode old fingerprints.
blog · wiz.io
3 OAuth TTPs Seen This Month — and How to Detect Them with Entra ID Logs
Three OAuth techniques attackers use in Azure, and how Entra ID sign-in logs and JWT claims expose them; includes Wiz telemetry on prevalence and ready-to-use KQL detection queries.
blog · semperis.com
Purple Knight Introduces Entra ID (formerly Azure AD) Security Indicators
Purple Knight 1.5 adds 10 Entra ID security indicators so organizations can assess gaps across on-prem AD and the cloud, plus MITRE D3FEND tags, seven new on-prem indicators, and enhanced HTML/PDF reporting.
blog · semperis.com
Hybrid Identity Protection: IAM Expert Daniel Stefaniak
HIP Podcast with IAM expert Daniel Stefaniak (Domino Data Lab), prompted by a finding that only 14% of developers prioritize app security: performance-over-security tradeoffs, MFA fatigue, and how Azure AD handles MFA.
blog · semperis.com
New Azure AD Security Indicators Help Protect Hybrid Identity Environments
Semperis adds Azure AD threat indicators to Directory Services Protector, complementing on-prem AD monitoring; explains how cloud credential compromise escalates into on-prem privileges and details indicators like unused administrative units.
back