Detecting Hybrid Identity Backdoors in Entra ID and AD FS (T1556.007)

Most large organizations run identity in two places: Active Directory on premises and a cloud identity provider. The glue between them is a high value target. MITRE ATT&CK technique T1556.007, Hybrid Identity, covers backdooring cloud authentication that is tied to on-premises identities. The tactics are defense impairment, persistence and credential access. Platforms are IaaS, Identity Provider, Office Suite, SaaS and Windows.

How hybrid identity works

MITRE describes three ways Microsoft Entra ID synchronizes identities with Active Directory.

• Password Hash Synchronization (PHS). A privileged on-premises account synchronizes password hashes between Active Directory and Entra ID, so authentication to Entra ID happens entirely in the cloud.
• Pass Through Authentication (PTA). Entra ID authentication attempts are forwarded to an on-premises PTA agent, which validates the credentials against Active Directory.
• Active Directory Federation Services (AD FS). A trust relationship is set up between Active Directory and Entra ID.

AD FS can also be used with other SaaS and cloud platforms such as AWS and GCP. They hand authentication to AD FS and receive a token with the hybrid user's identity and privileges.

How attackers use it

By changing the process tied to hybrid identities, an adversary may establish persistent privileged access to cloud resources. MITRE gives three examples.

1. PTA agent server. An adversary who compromises an on-premises server running a PTA agent may inject a malicious DLL into the AzureADConnectAuthenticationAgentService process. The DLL authorizes all attempts to authenticate to Entra ID and records user credentials.
2. AD FS configuration. In AD FS environments, an adversary may edit the Microsoft.IdentityServer.Servicehost configuration file to load a malicious DLL that generates authentication tokens for any user with any set of claims. This bypasses multi-factor authentication and defined AD FS policies.
3. From the cloud side. An adversary who compromises a Global Administrator account in an Entra ID tenant may register a new PTA agent through the web console, which similarly lets them harvest credentials and sign in as any user.

The theme is that the weak point is a server or an administrator account, and the effect lands on every cloud sign-in.

How to detect it

MITRE lists no data sources on this page, but its audit mitigation gives concrete places to look.

• PTA agent inventory. Any agent in the Entra ID management portal that you did not approve.
• AD FS binaries. Unsigned or non-Microsoft DLLs and executables in the AD FS and Global Assembly Cache directories.
• Configuration changes. Edits to the AD FS service host configuration file.
• Process behavior. Unexpected module loads in the PTA agent service process. Sysmon event 7 records image loads.
• Tenant audit logs. Registration of new agents, changes to federation settings, and new Global Administrator assignments.
• Token anomalies. Sign-ins for users that did not authenticate through the normal path.

How to reduce the risk

MITRE lists three mitigations.

1. Multi-factor authentication. Strong MFA policy reduces the risk of valid credentials leading to access, and it can limit access to cloud resources and APIs.
2. Audit. Review the hybrid identity solution periodically for discrepancies. For example, review all PTA agents in the Entra ID Management Portal and spot unapproved ones. If AD FS is in use, review DLLs and executables in the AD FS and Global Assembly Cache directories to confirm they are signed by Microsoft. MITRE notes that legitimate exceptions can exist, so verify them rather than assume.
3. Privileged account management. Limit on-premises accounts with access to the hybrid identity solution. For instance, limit Entra ID Global Administrator accounts to those required, and make them dedicated cloud only accounts instead of hybrid ones.

Treat servers running PTA agents, Entra Connect and AD FS as tier zero assets: same patching, logging and admin restrictions as domain controllers.

Check your own environment

Run through this list:

• Which synchronization method do you use, and why? Remove the ones you do not need.
• How many PTA agents are registered, and does each map to a known server?
• Who holds the Global Administrator role, and are those accounts cloud only?
• Are AD FS and Entra Connect servers inside your most restricted admin tier?
• Is MFA enforced outside the AD FS policy as well, in the cloud tenant?

A read-only signature check on the AD FS server, in PowerShell:

# List AD FS binaries with their signature status
Get-ChildItem "C:\Windows\ADFS" -Filter *.dll | Get-AuthenticodeSignature | Select-Object Path, Status, @{n='Signer';e={$_.SignerCertificate.Subject}}

Anything that is not signed by Microsoft needs an explanation.

Quick check

Sources

• MITRE ATT&CK T1556.007 Hybrid Identity