Techniques › T1556 › T1556.007
T1556.007 Hybrid Identity
defense impairment · persistence · credential access — IaaS, Identity Provider, Office Suite, SaaS, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
5
analytics
0
Sigma rules tagged attack.t1556.007
0
KEV CVEs mapped here
<p>Adversaries may patch, modify, or otherwise backdoor cloud authentication processes that are tied to on-premises user identities in order to bypass typical authentication mechanisms, access credentials, and enable persistent access to accounts.</p><p>Many organizations maintain hybrid user and device identities that are shared between on-premises and cloud-based environments. These can be maintained in a number of ways. For example, Microsoft Entra ID includes three options for synchronizing identities between Active Directory and Entra ID:</p>
- <li>Password Hash Synchronization (PHS), in which a privileged on-premises account synchronizes user password hashes between Active Directory and Entra ID, allowing authentication to Entra ID to take place entirely in the cloud </li><li>Pass Through Authentication (PTA), in which Entra ID authentication attempts are forwarded to an on-premises PTA agent, which validates the credentials against Active Directory </li><li>Active Directory Federation Services (AD FS), in which a trust relationship is established between Active Directory and Entra ID </li>
AzureADConnectAuthenticationAgentService process that authorizes all attempts to authenticate to Entra ID, as well as records user credentials. In environments using AD FS, an adversary may edit the Microsoft.IdentityServer.Servicehost configuration file to load a malicious DLL that generates authentication tokens for any user with any set of claims, thereby bypassing multi-factor authentication and defined AD FS policies.</p><p>In some cases, adversaries may be able to modify the hybrid identity authentication process from the cloud. For example, adversaries who compromise a Global Administrator account in an Entra ID tenant may be able to register a new PTA agent via the web console, similarly allowing them to harvest credentials and log into the Entra ID environment as any user.</p>KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0293 Detect Hybrid Identity Authentication Process Modification v1.0
AN0814 WindowsDetects injection or tampering of DLLs in hybrid identity agents (e.g., AzureADConnectAuthenticationAgentService), registry or configuration changes tied to PTA/AD FS, and anomalous LSASS or AD FS module loads correlated with authentication anomalies.Tunable:
WatchedServicesTimeWindowAN0815 Identity ProviderDetects registration of new PTA agents, conditional access changes disabling hybrid MFA enforcement, or suspicious updates to AD FS token-signing configurations.Tunable:PrivilegedRolesAN0816 IaaSDetects API calls registering or updating hybrid identity connectors, modification of cloud-to-on-premises federation trust, and unusual token issuance logs.AWS:CloudTrailUpdateFederationSettings or RegisterHybridConnector→ DC0069 Cloud Service ModificationTunable:MonitoredFederationsAN0817 Office SuiteDetects tenant-wide authentication or conditional access changes that weaken hybrid identity enforcement, including disabling AD FS or bypassing hybrid MFA policies.m365:unifiedModify Federation Settings or Update Authentication Policy→ DC0038 Application Log ContentTunable:PolicyScopeAN0818 SaaSDetects suspicious changes to SAML/OAuth federation configurations, such as new signing certificates, altered endpoints, or claims issuance rules granting elevated privileges.saas:oktaFederation configuration update or signing certificate change→ DC0038 Application Log ContentTunable:FederationEndpoints
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1556.007
No Sigma rule carries this tag. MITRE publishes a detection strategy above, so the behaviour is specified; what is missing is public detection content.
Rules tagged at the parent level (attack.t1556) 12
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: Corissa Koopmans, '@corissalea'
· 2022-07-19 · logsource: product=azure service=auditlogs · 26e7c5e2-6545-481e-b7e6-050143459635
Monitor and alert on conditional access changes where non approved actor removed CA Policy.
Author: Harjot Shah Singh, '@cyb3rjy0t'
· 2024-03-26 · logsource: product=azure service=auditlogs · 4bb80281-3756-4ec8-a88e-523c5a6fda9e
Detects newly added root certificate authority to an AzureAD tenant to support certificate based authentication.
Author: AlertIQ
· 2021-10-10 (modified 2022-12-25) · logsource: product=azure service=auditlogs · 4d78a000-ab52-4564-88a5-7ab5242b20c7
Change to authentication method could be an indicator of an attacker adding an auth method to the account so they can have continued access.
Author: Corissa Koopmans, '@corissalea'
· 2022-07-19 (modified 2024-05-28) · logsource: product=azure service=auditlogs · 50a3c7aa-ec29-44a4-92c1-fce229eef6fc
Monitor and alert on conditional access changes. Is Initiated by (actor) approved to make changes? Review Modified Properties and compare "old" vs "new" value.
Author: Mark Morowczynski '@markmorow', Thomas Detzner '@tdetzner'
· 2022-08-04 · logsource: product=azure service=auditlogs · 665e2d43-70dc-4ccc-9d27-026c9dd7ed9c
Monitor and alert on group membership removal of groups that have CA policy modification access
Author: @ionsor
· 2022-02-08 (modified 2026-04-30) · logsource: product=azure service=auditlogs · 7ea78478-a4f9-42a6-9dcd-f861816122bf
Detection for when multi factor authentication has been disabled, which might indicate a malicious activity to bypass authentication mechanisms.
Author: Muhammad Faisal (@faisalusuf)
· 2023-01-29 (modified 2024-07-22) · logsource: product=github service=audit · 8622c92d-c00e-463c-b09d-fd06166f6794
Detects when a user disables a critical security feature for an organization.
Author: Mark Morowczynski '@markmorow', Thomas Detzner '@tdetzner'
· 2022-08-04 · logsource: product=azure service=auditlogs · 91c95675-1f27-46d0-bead-d1ae96b97cd3
Monitor and alert on group membership additions of groups that have CA policy modification access
Author: Nischal Khadgi
· 2024-07-11 · logsource: product=windows category=registry_set · b61e87c0-50db-4b2e-8986-6a2be94b33b0
Detects changes to "DsrmAdminLogonBehavior" registry value.
During a Domain Controller (DC) promotion, administrators create a Directory Services Restore Mode (DSRM) local administrator account with a password that rarely changes. The DSRM account is an “Administrator” account that logs in with the DSRM mode when the server is booting up to restore AD backups or recover the server from a failure.
Attackers could abuse DSRM account to maintain their persistence and access to the organization's Active Directory.
If the "DsrmAdminLogonBehavior" value is set to "0", the administrator account can only be used if the DC starts in DSRM.
If the "DsrmAdminLogonBehavior" value is set to "1", the administrator account can only be used if the local AD DS service is stopped.
If the "DsrmAdminLogonBehavior" value is set to "2", the administrator account can always be used.
Author: Harjot Shah Singh, '@cyb3rjy0t'
· 2024-03-26 · logsource: product=azure service=auditlogs · c2496b41-16a9-4016-a776-b23f8910dc58
Detects when certificate based authentication has been enabled in an Azure Active Directory tenant.
Author: Michael McIntyre @wtfender
· 2023-09-27 · logsource: product=aws service=cloudtrail · d3adb3ef-b7e7-4003-9092-1924c797db35
Detects a change in the AWS Identity Center (FKA AWS SSO) identity provider.
A change in identity provider allows an attacker to establish persistent access or escalate privileges via user impersonation.
Author: Nasreddine Bencherchali (Nextron Systems), Elastic (idea)
· 2022-10-17 · logsource: product=windows service=security · f598ea0c-c25a-4f72-a219-50c44411c791
Detects possible addition of shadow credentials to an active directory object.