---
id: 9511
title: "Entra Connect Attacker Tradecraft: Part 3"
source_domain: specterops.io
source_url: "https://specterops.io/blog/2025/07/30/entra-connect-attacker-tradecraft-part-3/"
published_at: "2025-07-30T16:37:27Z"
phying_url: "https://phying.com/item/9511"
lang: en
---

# Entra Connect Attacker Tradecraft: Part 3

## Summary

How Entra Connect and Intune can be abused via userCertificate hijacking to bypass conditional access and compromise hybrid domains

## Intelligence Metadata

- **Sources:** specterops.io
- **Published:** 2025-07-30T16:37:27Z
- **Original:** https://specterops.io/blog/2025/07/30/entra-connect-attacker-tradecraft-part-3/
- **Phying News:** https://phying.com/item/9511