Comments on: Microsoft Reports New Attack Using Azure AD Connect

By: Adenilson Santos

Adenilson Santos — Thu, 13 Apr 2023 19:52:57 +0000

Is there any IoC to register on the organizations blacklist?

By: Everyone Seems to Do This

Everyone Seems to Do This — Mon, 10 Apr 2023 23:30:25 +0000

None of your users in on prem active directory should match/sync to a global admin in AzureAD or someone popping the domain gets to pop all your Azure resources as well.

By: Saqib

Saqib — Mon, 10 Apr 2023 17:56:40 +0000

The way the attackers started with a GA were by dumping in-memory credentials of the service accounts. So it would be good to have Credential Guard enabled on the Azure AD connect server. That would not allow dumping the creds from memory.