MachineAccountQuota Transitive Quota: 110 Accounts and Beyond

Kevin Robertson details ten attacker rules for MachineAccountQuota, which lets unprivileged users add up to 10 machine accounts, plus Powermad techniques and the defense of setting MAQ to 0.

NetSPI discovered Nested App Authentication (BroCI) flows that bypass Entra Conditional Access policies to mint Graph API tokens, mainly a post-phishing persistence vector; Microsoft has fixed it.

Contributor access to an Azure ARM API Connection allows creating role assignments as the connected user; path traversal escalated Logic App Contributor to tenant Root Owner, disclosed to MSRC.

A now-patched Azure escalation path let Log Analytics Contributor abuse Automation Account rights to reach full Subscription Contributor via Run As accounts; walkthrough of the MSRC report included.

Kevin Robertson expands on ADIDNS attacks, covering why WPAD records fail against the global query block list and demonstrating GQBL bypasses with wildcard, DNAME, and NS records.

Kevin Robertson argues ADIDNS beats LLMNR/NBNS spoofing for MITM attacks in AD environments: attackers with unprivileged access can add wildcard records that intercept name resolution domain-wide.