Azure Active Directory (Azure AD) 是微软基于云的身份和访问管理服务。它在使员工能够登录并访问资源方面发挥着重要作用,无论是在组织内部还是超出组织范围,包括 Microsoft 365、Azure 门户和众多其他 SaaS 应用程序。Azure AD 的设计侧重于提供基本的身份服务,主要包括身份验证、授权和用户管理。
Azure AD 的关键功能包括多因素身份验证和有条件访问,以及与其他 Microsoft 安全服务的无缝集成。这些功能显著提升了用户身份的安全性,并赋予组织有效实施和执行其访问策略的能力。作为微软云服务生态系统的基本组成部分,Azure AD 对于用户身份的基于云的管理至关重要。
Az PowerShell 是一个用于管理 Azure 资源的模块,可通过 PowerShell 命令行使用。
连接
azlogin#This will open the browserazlogin-u<username>-p<password>#Specify user and passwordazlogin--identity#Use the current machine managed identity (metadata)az login --identity -u /subscriptions/<subscriptionId>/resourcegroups/myRG/providers/Microsoft.ManagedIdentity/userAssignedIdentities/myID #Login with user managed identity
# Login as service principalaz login --service-principal -u http://azure-cli-2016-08-05-14-31-15 -p VerySecret --tenant contoso.onmicrosoft.com #With password
az login --service-principal -u http://azure-cli-2016-08-05-14-31-15 -p ~/mycertfile.pem --tenant contoso.onmicrosoft.com #With cert
# Request access token (ARM)azaccountget-access-token# Request access token for different resource. Supported tokens: aad-graph, arm, batch, data-lake, media, ms-graph, oss-rdbms
azaccountget-access-token--resource-typeaad-graph# If you want to configure some defaultsazconfigure# Get user logged-in alreadyazadsigned-in-usershow# Helpazfind"vm"# Find vm commandsazvm-h# Get subdomainsazaduserlist--query-examples# Get examples
Connect-AzureAD#Open browser# Using credentials$passwd =ConvertTo-SecureString"Welcome2022!"-AsPlainText -Force$creds =New-Object System.Management.Automation.PSCredential ("test@corp.onmicrosoft.com", $passwd)Connect-AzureAD-Credential $creds# Using tokens## AzureAD cannot request tokens, but can use AADGraph and MSGraph tokens to connectConnect-AzureAD-AccountId test@corp.onmicrosoft.com -AadAccessToken $token
Connect-AzAccount#Open browser# Using credentials$passwd =ConvertTo-SecureString"Welcome2022!"-AsPlainText -Force$creds =New-Object System.Management.Automation.PSCredential("test@corp.onmicrosoft.com", $passwd)Connect-AzAccount-Credential $creds# Get Access Token(Get-AzAccessToken).Token# Request access token to other endpoints: AadGraph, AnalysisServices, Arm, Attestation, Batch, DataLake, KeyVault, MSGraph, OperationalInsights, ResourceManager, Storage, Synapse
Get-AzAccessToken-ResourceTypeName MSGraph(Get-AzAccessToken-Resource "https://graph.microsoft.com").Token# Conenct with access tokenConnect-AzAccount-AccountId test@corp.onmicrosoft.com -AccessToken $tokenConnect-AzAccount-AccessToken $token -GraphAccessToken $graphaccesstoken -AccountId <ACCOUNT-ID>## The -AccessToken is from management.azure.com# Connect with Service principal/enterprise app secret$password =ConvertTo-SecureString'KWEFNOIRFIPMWL.--DWPNVFI._EDWWEF_ADF~SODNFBWRBIF'-AsPlainText -Force$creds =New-ObjectSystem.Management.Automation.PSCredential('2923847f-fca2-a420-df10-a01928bec653', $password)Connect-AzAccount-ServicePrincipal -Credential $creds -Tenant 29sd87e56-a192-a934-bca3-0398471ab4e7d#All the Azure AD cmdlets have the format *-AzAD*Get-Command*azad*#Cmdlets for other Azure resources have the format *Az*Get-Command*az*
# The important part is the ClientId, which identifies the application to login inside Azure$token =Invoke-Authorize-Credential $credential `-ClientId '1dfb5f98-f363-4b0f-b63a-8d20ada1e62d'`-Scope 'Files.Read.All openid profile Sites.Read.All User.Read email'`-Redirect_Uri "https://graphtryit-staging.azurewebsites.net/"`-Verbose -Debug `-InformationAction Continue$token =Invoke-Authorize-Credential $credential `-ClientId '65611c08-af8c-46fc-ad20-1888eb1b70d9'`-Scope 'openid profile Sites.Read.All User.Read email'`-Redirect_Uri "chrome-extension://imjekgehfljppdblckcmjggcoboemlah"`-Verbose -Debug `-InformationAction Continue$token =Invoke-Authorize-Credential $credential `-ClientId 'd3ce4cf8-6810-442d-b42e-375e14710095'`-Scope 'openid'`-Redirect_Uri "https://graphexplorer.azurewebsites.net/"`-Verbose -Debug `-InformationAction Continue
用户
# Enumerate usersazaduserlist--outputtableazaduserlist--query"[].userPrincipalName"# Get info of 1 userazadusershow--id"test@corp.onmicrosoft.com"# Search "admin" usersazaduserlist--query"[].displayName"|findstr/i"admin"azaduserlist--query"[?contains(displayName,'admin')].displayName"# Search attributes containing the word "password"azaduserlist|findstr/i"password"|findstr/v"null,"# All users from AzureADazaduserlist--query"[].{osi:onPremisesSecurityIdentifier,upn:userPrincipalName}[?osi==null]"azaduserlist--query"[?onPremisesSecurityIdentifier==null].displayName"# All users synced from on-premazaduserlist--query"[].{osi:onPremisesSecurityIdentifier,upn:userPrincipalName}[?osi!=null]"azaduserlist--query"[?onPremisesSecurityIdentifier!=null].displayName"# Get groups where the user is a memberazaduserget-member-groups--id<email># Get roles assigned to the userazroleassignmentlist--include-groups--include-classic-administratorstrue--assignee<email>
Azure AD
Enumeration
Azure AD enumeration can be performed using tools like Azure AD Recon or Azure AD Exploitation Framework. These tools can help in gathering information about users, groups, applications, and service principals in the Azure AD environment.
Password Spraying
Password spraying attacks can be conducted against Azure AD using tools like Spray or AzureSpray. These tools allow an attacker to attempt a few common passwords against many user accounts to avoid account lockouts and detection.
Phishing
Phishing attacks targeting Azure AD users can be executed to steal credentials or deliver malware. Attackers can create fake login pages or emails that mimic Azure AD login prompts to trick users into giving away their credentials.
Brute Force
BrHound is a tool that can be used to perform brute force attacks against Azure AD accounts. It can help in guessing weak passwords by trying different combinations until the correct one is found.
Token Manipulation
Attackers can manipulate tokens in Azure AD to escalate privileges or access resources they are not authorized to. Tools like Rubeus can be used to perform Kerberos ticket attacks and manipulate tokens to achieve persistence in the Azure AD environment.
Account Takeover
Once an attacker has valid credentials, they can perform an account takeover in Azure AD. Attackers can change account settings, access sensitive information, or perform unauthorized actions using the compromised account.
Data Exfiltration
Attackers can exfiltrate sensitive data from Azure AD using techniques like OAuth abuse or Application token extraction. By abusing OAuth tokens or extracting application tokens, attackers can steal valuable information stored in Azure AD.
Persistence
To maintain access in Azure AD, attackers can establish persistence using methods like backdoors, malicious apps, or OAuth backdoors. These techniques allow attackers to maintain access even after remediation efforts are made by the defenders.
# Enumerate UsersGet-AzureADUser-All $trueGet-AzureADUser-All $true| select UserPrincipalName# Get info of 1 userGet-AzureADUser-ObjectId test@corp.onmicrosoft.com | fl# Search "admin" usersGet-AzureADUser-SearchString "admin"#Search admin at the begining of DisplayName or userPrincipalNameGet-AzureADUser-All $true|?{$_.Displayname-match"admin"} #Search "admin" word in DisplayName# Get all attributes of a userGet-AzureADUser-ObjectId test@defcorphq.onmicrosoft.com|%{$_.PSObject.Properties.Name}# Search attributes containing the word "password"Get-AzureADUser -All $true |%{$Properties = $_;$Properties.PSObject.Properties.Name | % {if ($Properties.$_ -match 'password') {"$($Properties.UserPrincipalName) - $_ - $($Properties.$_)"}}}
# All users from AzureAD# All users from AzureADGet-AzureADUser-All $true|?{$_.OnPremisesSecurityIdentifier-eq$null}# All users synced from on-premGet-AzureADUser-All $true|?{$_.OnPremisesSecurityIdentifier-ne$null}# Objects created by a/any userGet-AzureADUser [-ObjectId<email>] |Get-AzureADUserCreatedObject# Devices owned by a userGet-AzureADUserOwnedDevice-ObjectId test@corp.onmicrosoft.com# Objects owned by a specific userGet-AzureADUserOwnedObject-ObjectId test@corp.onmicrosoft.com# Get groups & roles where the user is a memberGet-AzureADUserMembership-ObjectId 'test@corp.onmicrosoft.com'# Get devices owned by a userGet-AzureADUserOwnedDevice-ObjectId test@corp.onmicrosoft.com# Get devices registered by a userGet-AzureADUserRegisteredDevice-ObjectId test@defcorphq.onmicrosoft.com# Apps where a user has a role (role not shown)Get-AzureADUser-ObjectId roygcain@defcorphq.onmicrosoft.com |Get-AzureADUserAppRoleAssignment| fl *# Get Administrative Units of a user$userObj =Get-AzureADUser-Filter "UserPrincipalName eq 'bill@example.com'"Get-AzureADMSAdministrativeUnit | where { Get-AzureADMSAdministrativeUnitMember -Id $_.Id | where { $_.Id -eq $userObj.ObjectId } }
Az PowerShell
Enumerate Azure AD roles
Description: Enumerate Azure AD roles assigned to users or groups.
# Enumerate usersGet-AzADUser# Get details of a userGet-AzADUser-UserPrincipalName test@defcorphq.onmicrosoft.com# Search user by stringGet-AzADUser-SearchString "admin"#Search at the beginnig of DisplayNameGet-AzADUser|?{$_.Displayname-match"admin"}# Get roles assigned to a userGet-AzRoleAssignment-SignInName test@corp.onmicrosoft.com
# Enumerate groupsaz ad group listaz ad group list --query "[].[displayName]"-o table# Get info of 1 groupaz ad group show --group <group># Get "admin" groupsaz ad group list --query "[].displayName"| findstr /i "admin"az ad group list --query "[?contains(displayName,'admin')].displayName"# All groups from AzureADaz ad group list --query "[].{osi:onPremisesSecurityIdentifier,displayName:displayName,description:description}[?osi==null]"
az ad group list --query "[?onPremisesSecurityIdentifier==null].displayName"# All groups synced from on-premaz ad group list --query "[].{osi:onPremisesSecurityIdentifier,displayName:displayName,description:description}[?osi!=null]"
az ad group list --query "[?onPremisesSecurityIdentifier!=null].displayName"# Get members of groupaz ad group member list --group <group>--query "[].userPrincipalName"-o table# Check if member of groupaz ad group member check --group "VM Admins"--member-id <id># Get which groups a group is member ofaz ad group get-member-groups -g "VM Admins"# Get Apps where a group has a role (role not shown)Get-AzureADGroup-ObjectId <id>|Get-AzureADGroupAppRoleAssignment| fl *
Azure AD
Enumeration
Azure AD enumeration can be performed using various techniques such as:
User Enumeration: Enumerating valid usernames through methods like user enumeration APIs, password reset functionality, or by analyzing error messages.
Group Enumeration: Identifying Azure AD groups and their members to understand the organization's structure.
Application Enumeration: Discovering applications registered in Azure AD to identify potential targets for attacks.
Device Enumeration: Enumerating devices registered in Azure AD to assess the device landscape within the organization.
Exploitation
Exploiting Azure AD involves techniques like:
Password Spraying: Attempting to authenticate using common passwords across multiple accounts to avoid account lockouts.
Brute Force Attacks: Trying various password combinations to gain unauthorized access to Azure AD accounts.
Phishing Attacks: Using deceptive emails or websites to trick users into revealing their credentials, which can then be used to compromise Azure AD accounts.
Token Impersonation: Exploiting weaknesses in token handling to impersonate users or gain unauthorized access to resources.
Post-Exploitation
After gaining access to Azure AD, an attacker can perform various post-exploitation activities such as:
Privilege Escalation: Elevating privileges within Azure AD to gain access to more sensitive information or perform administrative actions.
Data Exfiltration: Stealing data from Azure AD, suchjson web tokens (JWTs), user information, or sensitive documents.
Persistence: Establishing persistence within Azure AD to maintain access even after being detected and removed.
Account Takeover: Taking control of user accounts to perform unauthorized actions or access confidential data.
# Enumerate GroupsGet-AzureADGroup-All $true# Get info of 1 groupGet-AzADGroup-DisplayName <resource_group_name>| fl# Get "admin" groupsGet-AzureADGroup-SearchString "admin"| fl #Groups starting by "admin"Get-AzureADGroup-All $true|?{$_.Displayname-match"admin"} #Groups with the word "admin"# Get groups allowing dynamic membershipGet-AzureADMSGroup|?{$_.GroupTypes-eq'DynamicMembership'}# All groups that are from Azure ADGet-AzureADGroup-All $true|?{$_.OnPremisesSecurityIdentifier-eq$null}# All groups that are synced from on-prem (note that security groups are not synced)Get-AzureADGroup-All $true|?{$_.OnPremisesSecurityIdentifier-ne$null}# Get members of a groupGet-AzureADGroupMember-ObjectId <group_id># Get roles of groupGet-AzureADMSGroup-SearchString "Contoso_Helpdesk_Administrators"#Get group idGet-AzureADMSRoleAssignment-Filter "principalId eq '69584002-b4d1-4055-9c94-320542efd653'"# Get Administrative Units of a group$groupObj =Get-AzureADGroup-Filter "displayname eq 'TestGroup'"Get-AzureADMSAdministrativeUnit | where { Get-AzureADMSAdministrativeUnitMember -Id $_.Id | where {$_.Id -eq $groupObj.ObjectId} }
Az PowerShell
Connect to Azure AD
To connect to Azure AD using Az PowerShell, you can use the following command:
Connect-AzAccount
This command will open a dialog box for you to enter your Azure AD credentials.
List Azure AD Users
To list all Azure AD users using Az PowerShell, you can use the following command:
Get-AzADUser
This command will retrieve a list of all Azure AD users in your tenant.
Get Azure AD User
To get information about a specific Azure AD user, you can use the following command:
Get-AzADUser-UserPrincipalName user@example.com
Replace user@example.com with the user's actual UPN.
Create Azure AD User
To create a new Azure AD user using Az PowerShell, you can use the following command:
Replace user@example.com with the user's actual UPN.
# Get all groupsGet-AzADGroup# Get details of a groupGet-AzADGroup-ObjectId <id># Search group by stringGet-AzADGroup-SearchString "admin"| fl *#Search at the beginnig of DisplayNameGet-AzADGroup|?{$_.Displayname-match"admin"}# Get members of groupGet-AzADGroupMember-GroupDisplayName <resource_group_name># Get roles of groupGet-AzRoleAssignment-ResourceGroupName <resource_group_name>
# Get Service Principalsazadsplist--allazadsplist--all--query"[].[displayName]"-otable# Get details of one SPazadspshow--id00000000-0000-0000-0000-000000000000# Search SP by stringazadsplist--all--query"[?contains(displayName,'app')].displayName"# Get owner of service principalazadspownerlist--id<id>--query"[].[displayName]"-otable# Get service principals owned by the current userazadsplist--show-mine# List apps that have password credentialsazadsplist--all--query"[?passwordCredentials != null].displayName"# List apps that have key credentials (use of certificate authentication)azadsplist-all--query"[?keyCredentials != null].displayName"
Azure AD
Enumeration
Azure AD enumeration can be performed using various techniques such as:
User Enumeration: Enumerating valid usernames through the login interface or other means.
Group Enumeration: Identifying Azure AD groups and their members.
Application Enumeration: Discovering registered applications in Azure AD.
Service Principal Enumeration: Identifying service principals and their permissions.
Device Enumeration: Enumerating devices registered in Azure AD.
Exploitation
Exploitation of Azure AD may involve techniques like:
Password Spraying: Attempting to authenticate using common passwords across multiple accounts.
Phishing Attacks: Tricking users into providing their credentials through fake login pages.
Brute Force Attacks: Trying various password combinations to gain unauthorized access.
Token Impersonation: Stealing or forging tokens to impersonate users or applications.
OAuth Abuse: Exploiting misconfigurations in OAuth implementations for unauthorized access.
Post-Exploitation
After gaining access to Azure AD, an attacker may perform actions like:
Data Exfiltration: Stealing sensitive data stored in Azure AD.
Privilege Escalation: Elevating privileges to gain more control over Azure AD resources.
Persistence: Maintaining access to Azure AD even after being detected.
Account Takeover: Taking control of user accounts for malicious purposes.
# Get Service PrincipalsGet-AzureADServicePrincipal-All $true# Get details about a SPGet-AzureADServicePrincipal-ObjectId <id>| fl *# Get SP by string name or IdGet-AzureADServicePrincipal-All $true|?{$_.DisplayName-match"app"} | flGet-AzureADServicePrincipal-All $true|?{$_.AppId-match"103947652-1234-5834-103846517389"}# Get owner of SPGet-AzureADServicePrincipal-ObjectId <id>|Get-AzureADServicePrincipalOwner|fl *# Get objects owned by a SPGet-AzureADServicePrincipal-ObjectId <id>|Get-AzureADServicePrincipalOwnedObject# Get objects created by a SPGet-AzureADServicePrincipal-ObjectId <id>|Get-AzureADServicePrincipalCreatedObject# Get groups where the SP is a memberGet-AzureADServicePrincipal|Get-AzureADServicePrincipalMembershipGet-AzureADServicePrincipal-ObjectId <id>|Get-AzureADServicePrincipalMembership|fl *
在 Azure AD 中,可以使用 Az PowerShell 模块来执行各种管理任务。以下是一些示例:
安装 Az PowerShell 模块:
Install-Module-Name Az -AllowClobber -Scope CurrentUser
# Get SPsGet-AzADServicePrincipal# Get info of 1 SPGet-AzADServicePrincipal-ObjectId <id># Search SP by stringGet-AzADServicePrincipal|?{$_.DisplayName-match"app"}# Get roles of a SPGet-AzRoleAssignment-ServicePrincipalName <String>
</details>
### 角色
<div data-gb-custom-block data-tag="tabs"></div>
<div data-gb-custom-block data-tag="tab" data-title='az cli'>
```bash
# Get roles
az role definition list
# Get assigned roles
az role assignment list --all --query "[].roleDefinitionName"
az role assignment list --all | jq '.[] | .roleDefinitionName,.scope'
# Get info of 1 role
az role definition list --name "AzureML Registry User"
# Get only custom roles
az role definition list --custom-role-only
# Get only roles assigned to the resource group indicated
az role definition list --resource-group <resource_group>
# Get only roles assigned to the indicated scope
az role definition list --scope <scope>
# Get all the principals a role is assigned to
az role assignment list --all --query "[].{principalName:principalName,principalType:principalType,resourceGroup:resourceGroup,roleDefinitionName:roleDefinitionName}[?roleDefinitionName=='<ROLE_NAME>']"
Azure AD
Enumeration
Azure AD enumeration can be performed using various techniques such as:
User Enumeration: Enumerating valid usernames through the login interface or other means.
Group Enumeration: Identifying Azure AD groups and their members.
Application Enumeration: Discovering registered applications in Azure AD.
Device Enumeration: Identifying devices registered in Azure AD.
Exploitation
Common exploitation techniques in Azure AD include:
Password Spraying: Attempting to authenticate using common passwords across multiple accounts.
Phishing Attacks: Sending fraudulent emails to trick users into providing their credentials.
Brute Force Attacks: Trying multiple password combinations to gain unauthorized access.
Token Impersonation: Stealing or forging tokens to impersonate users or applications.
Post-Exploitation
After gaining access to Azure AD, an attacker may perform actions like:
User Account Takeover: Taking control of user accounts to access resources.
Data Exfiltration: Stealing sensitive data stored in Azure AD.
Privilege Escalation: Elevating privileges to gain more control over Azure AD resources.
Persistence: Maintaining access to Azure AD by creating backdoors or other means.
# Get all available role templatesGet-AzureADDirectoryroleTemplate# Get enabled roles (Assigned roles)Get-AzureADDirectoryRoleGet-AzureADDirectoryRole-ObjectId <roleID>#Get info about the role# Get custom roles - use AzureAdPreviewGet-AzureADMSRoleDefinition|?{$_.IsBuiltin-eq$False} | select DisplayName# Users assigned a role (Global Administrator)Get-AzureADDirectoryRole-Filter "DisplayName eq 'Global Administrator'"|Get-AzureADDirectoryRoleMemberGet-AzureADDirectoryRole-ObjectId <id>| fl# Roles of the Administrative Unit (who has permissions over the administrative unit and its members)Get-AzureADMSScopedRoleMembership-Id <id>| fl *
在 Azure AD 中,可以使用 Az PowerShell 模块执行各种操作,包括管理用户、组、应用程序等。以下是一些常见的 Az PowerShell 命令示例:
# Get role assignments on the subscriptionGet-AzRoleDefinition# Get Role definitionGet-AzRoleDefinition-Name "Virtual Machine Command Executor"# Get roles of a user or resourceGet-AzRoleAssignment-SignInName test@corp.onmicrosoft.comGet-AzRoleAssignment -Scope /subscriptions/<subscription-id>/resourceGroups/<res_group_name>/providers/Microsoft.Compute/virtualMachines/<vm_name>
Translate the relevant English text to Chinese and return the translation keeping excatly the same markdown and html syntax. Do not translate things like code, hacking technique names, hacking word, cloud/SaaS platform names (like Workspace, aws, gcp...), the word 'leak', pentesting, and markdown tags. Also don't add any extra stuff apart from the translation and markdown syntax.
# Get permissions over a resource using ARM directly$Token = (Get-AzAccessToken).Token$URI = 'https://management.azure.com/subscriptions/b413826f-108d-4049-8c11-d52d5d388768/resourceGroups/Research/providers/Microsoft.Compute/virtualMachines/infradminsrv/providers/Microsoft.Authorization/permissions?api-version=2015-07-01'
$RequestParams =@{Method ='GET'Uri = $URIHeaders =@{'Authorization'="Bearer $Token"}}(Invoke-RestMethod @RequestParams).value
设备
# If you know how to do this send a PR!
Azure AD
Enumeration
Azure AD enumeration can be performed using a variety of techniques, including:
User Enumeration: Enumerating valid usernames through the login interface or other means.
Group Enumeration: Identifying Azure AD groups and their members.
Application Enumeration: Discovering registered applications within Azure AD.
Password Spraying
Password spraying attacks against Azure AD involve attempting a small number of commonly used passwords against many accounts to avoid account lockouts and detection.
Brute Force Attacks
Brute force attacks against Azure AD involve systematically checking all possible passwords until the correct one is found.
Phishing
Phishing attacks targeting Azure AD users can be used to steal credentials or deliver malware.
Token Manipulation
Manipulating tokens issued by Azure AD can allow an attacker to escalate privileges or maintain persistence within the environment.
Password Policies
Understanding and bypassing Azure AD password policies can help in conducting successful password-based attacks.
Multi-Factor Authentication (MFA) Bypass
Finding ways to bypass or circumvent MFA in Azure AD can provide unauthorized access to accounts.
Password Hashes
Obtaining and cracking password hashes from Azure AD can lead to the disclosure of plaintext passwords.
Account Lockout Policies
Understanding and potentially bypassing account lockout policies in Azure AD can help in conducting brute force attacks without getting locked out.
OAuth Abuse
Abusing OAuth functionality in Azure AD can lead to unauthorized access to resources and sensitive data.
Federation Trusts
Exploiting misconfigurations in federation trusts can allow an attacker to gain unauthorized access to Azure AD resources.
Privilege Escalation
Identifying and exploiting privilege escalation vulnerabilities in Azure AD can lead to increased access and control over the environment.
Data Exfiltration
Exfiltrating sensitive data from Azure AD can result in the exposure of confidential information to unauthorized individuals.
Logging and Monitoring
Monitoring Azure AD logs and activities can help in detecting and responding to security incidents in a timely manner.
Security Best Practices
Following security best practices for Azure AD can help in mitigating common security risks and protecting the environment from potential threats.
# Enumerate DevicesGet-AzureADDevice-All $true| fl *# List all the active devices (and not the stale devices)Get-AzureADDevice-All $true|?{$_.ApproximateLastLogonTimeStamp-ne$null}# Get owners of all devicesGet-AzureADDevice-All $true|Get-AzureADDeviceRegisteredOwnerGet-AzureADDevice -All $true | %{if($user=Get-AzureADDeviceRegisteredOwner -ObjectId $_.ObjectID){$_;$user.UserPrincipalName;"`n"}}
# Registred users of all the devicesGet-AzureADDevice-All $true|Get-AzureADDeviceRegisteredUserGet-AzureADDevice -All $true | %{if($user=Get-AzureADDeviceRegisteredUser -ObjectId $_.ObjectID){$_;$user.UserPrincipalName;"`n"}}
# Get dives managed using IntuneGet-AzureADDevice-All $true|?{$_.IsCompliant-eq"True"}# Get devices owned by a userGet-AzureADUserOwnedDevice-ObjectId test@corp.onmicrosoft.com# Get Administrative Units of a deviceGet-AzureADMSAdministrativeUnit | where { Get-AzureADMSAdministrativeUnitMember -ObjectId $_.ObjectId | where {$_.ObjectId -eq $deviceObjId} }
# List Appsazadapplistazadapplist--query"[].[displayName]"-otable# Get info of 1 Appazadappshow--id00000000-0000-0000-0000-000000000000# Search App by stringazadapplist--query"[?contains(displayName,'app')].displayName"# Get the owner of an applicationazadappownerlist--id<id>--query"[].[displayName]"-otable# List all the apps with an application passwordazadapplist--query"[?passwordCredentials != null].displayName"# List apps that have key credentials (use of certificate authentication)azadapplist--query"[?keyCredentials != null].displayName"
Azure AD Enumeration
User Enumeration
Description: User enumeration can be performed through the Azure AD login interface by entering a valid username and observing the response.
Impact: User enumeration can help an attacker identify valid usernames in the Azure AD environment, which can be used in further attacks such as password spraying.
Recommendation: Implement account lockout policies to prevent brute force attacks and monitor failed login attempts for unusual patterns.
Group Enumeration
Description: Group enumeration can be done by querying the Azure AD Graph API to retrieve information about existing groups.
Impact: Knowledge of existing groups can help an attacker understand the organization's structure and potentially identify high-value targets.
Recommendation: Regularly review and update group memberships to ensure least privilege access.
Application Enumeration
Description: Application enumeration involves identifying applications registered in Azure AD.
Impact: Attackers can target specific applications with known vulnerabilities or misconfigurations to gain access to sensitive data.
Recommendation: Regularly review and audit registered applications, removing any unused or unnecessary ones.
Device Enumeration
Description: Device enumeration allows an attacker to gather information about devices registered in Azure AD.
Impact: Knowledge of registered devices can help attackers target specific devices for further exploitation.
Recommendation: Enforce device registration controls and regularly review registered devices for any anomalies.
Service Principal Enumeration
Description: Service principals represent applications or services in Azure AD, and enumeration involves identifying these principals.
Impact: Attackers can abuse misconfigured service principals to gain unauthorized access to resources.
Recommendation: Regularly review and update service principals, ensuring they have the least privileges necessary.
# List all registered applicationsGet-AzureADApplication-All $true# Get details of an applicationGet-AzureADApplication-ObjectId <id>| fl *# List all the apps with an application passwordGet-AzureADApplication-All $true|%{if(Get-AzureADApplicationPasswordCredential-ObjectID $_.ObjectID){$_}}# Get owner of an applicationGet-AzureADApplication-ObjectId <id>|Get-AzureADApplicationOwner|fl *
在 Azure AD 中,我们可以使用 Az PowerShell 模块来执行各种操作。以下是一些常见的示例:
Set-AzADGroup -DisplayName "Developers" -Description "Group for developers"
# Get Apps
Get-AzADApplication
# Get details of one App
Get-AzADApplication -ObjectId <id>
# Get App searching by string
Get-AzADApplication | ?{$_.DisplayName -match "app"}
# Get Apps with password
Get-AzADAppCredential
User Enumeration: Attackers can use methods like user enumeration through the Forgot Password feature or the OAuth token endpoint to gather valid usernames.
Group Enumeration: Attackers can also enumerate groups within the Azure AD tenant to understand the organization's structure and potentially identify high-value targets.
Brute Force Attacks
Password Spraying: Attackers can perform password spraying attacks against Azure AD accounts to avoid account lockouts and detection.
Credential Stuffing: Attackers can use previously leaked credentials to perform credential stuffing attacks against Azure AD accounts.
Phishing
OAuth Token Phishing: Attackers can phish for OAuth tokens to gain unauthorized access to Azure AD resources.
Credential Phishing: Attackers can conduct credential phishing campaigns to trick users into revealing their Azure AD credentials.
Exploiting Misconfigurations
Application Misconfigurations: Attackers can exploit misconfigured Azure AD applications to gain unauthorized access or escalate privileges within the tenant.
Permissions Misconfigurations: Attackers can abuse misconfigured permissions to perform lateral movement or access sensitive information.
Account Takeover
Password Spraying for Account Takeover: Attackers can use password spraying techniques to take over Azure AD accounts with weak passwords.
Brute Force for Account Takeover: Attackers can launch brute force attacks to gain unauthorized access to Azure AD accounts.
Insider Threats
Insider Account Compromise: Insiders with legitimate access can abuse their privileges to exfiltrate data or perform unauthorized actions within Azure AD.
Data Exfiltration: Insiders can exfiltrate sensitive data from Azure AD using their legitimate access.
Monitoring and Detection
Anomaly Detection: Implement anomaly detection mechanisms to identify unusual activities that could indicate a security breach.
Logging and Alerting: Ensure proper logging and alerting mechanisms are in place to detect and respond to suspicious activities in Azure AD.
Recommendations
Multi-Factor Authentication (MFA): Enforce MFA for all Azure AD accounts to add an extra layer of security.
Regular Security Training: Provide regular security awareness training to educate users about common attack techniques and how to avoid falling victim to them.
Least Privilege Access: Follow the principle of least privilege to restrict users' access rights within Azure AD to only what is necessary for their roles.
# Get Administrative Units
Get-AzureADMSAdministrativeUnit
Get-AzureADMSAdministrativeUnit -Id <id>
# Get ID of admin unit by string
$adminUnitObj = Get-AzureADMSAdministrativeUnit -Filter "displayname eq 'Test administrative unit 2'"
# List the users, groups, and devices affected by the administrative unit
Get-AzureADMSAdministrativeUnitMember -Id <id>
# Get the roles users have over the members of the AU
Get-AzureADMSScopedRoleMembership -Id <id> | fl #Get role ID and role members
Azure AD Identity Protection (AIP)
Azure AD Identity Protection (AIP)是一项安全服务,利用自动检测和纠正来帮助保护Azure Active Directory中用户身份免受 compromise。AIP持续监视和评估用户登录和身份配置的风险,自动应用适当的安全措施,例如要求多重身份验证或阻止潜在危险活动。这有助于组织预防基于身份的安全漏洞。
流程:
Azure AD Identity Protection 监视用户活动,收集用户登录、认证事件和其他相关活动的数据。
该服务使用机器学习算法分析这些数据,检测潜在的安全威胁。
Azure AD Identity Protection 为威胁分配风险级别(例如登录),并在需要时生成警报以执行一些自动操作。
Azure AD Password Protection (APP)
Azure AD Password Protection (APP)是一项安全功能,通过强制执行强密码策略,帮助防止Azure Active Directory中的弱密码。APP阻止常用的弱密码及其变体,降低与密码相关的风险。它可以在云级别和本地Active Directory上都应用,增强组织整体的密码安全性。