Az - AzureAD (AAD)

Lernen Sie und üben Sie AWS-Hacking:HackTricks Training AWS Red Team Expert (ARTE) Lernen Sie und üben Sie GCP-Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Unterstützen Sie HackTricks

• Überprüfen Sie die Abonnementpläne!

• Treten Sie der 💬 Discord-Gruppe oder der Telegram-Gruppe bei oder folgen Sie uns auf Twitter 🐦 @hacktricks_live.

• Teilen Sie Hacking-Tricks, indem Sie PRs an die HackTricks und HackTricks Cloud Github-Repositorys senden.

Grundlegende Informationen

Azure Active Directory (Azure AD) dient als cloudbasierter Dienst von Microsoft für Identitäts- und Zugriffsverwaltung. Es ist entscheidend, um Mitarbeitern das Anmelden und den Zugriff auf Ressourcen zu ermöglichen, sowohl innerhalb als auch außerhalb der Organisation, einschließlich Microsoft 365, des Azure-Portals und einer Vielzahl anderer SaaS-Anwendungen. Das Design von Azure AD konzentriert sich darauf, wesentliche Identitätsdienste bereitzustellen, insbesondere Authentifizierung, Autorisierung und Benutzerverwaltung.

Zu den wichtigsten Funktionen von Azure AD gehören Mehr-Faktor-Authentifizierung und bedingter Zugriff, zusammen mit einer nahtlosen Integration mit anderen Microsoft-Sicherheitsdiensten. Diese Funktionen erhöhen die Sicherheit von Benutzeridentitäten erheblich und ermöglichen es Organisationen, ihre Zugriffsrichtlinien effektiv umzusetzen und durchzusetzen. Als grundlegender Bestandteil des cloudbasierten Diensteökosystems von Microsoft ist Azure AD entscheidend für das cloudbasierte Management von Benutzeridentitäten.

Entitäten

Enumeration

Für diese Enumeration können Sie das az cli tool, das PowerShell-Modul AzureAD (oder AzureAD Preview) und das Az PowerShell-Modul verwenden.

Auf Linux müssen Sie PowerShell Core installieren:

sudo apt-get update
sudo apt-get install -y wget apt-transport-https software-properties-common

# Ubuntu 20.04
wget -q https://packages.microsoft.com/config/ubuntu/20.04/packages-microsoft-prod.deb

# Update repos
sudo apt-get update
sudo add-apt-repository universe

# Install & start powershell
sudo apt-get install -y powershell
pwsh

# Az cli
curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash

Modulunterschiede

• AzureAD ist ein PowerShell-Modul von Microsoft zur Verwaltung von Azure AD. Es zeigt nicht alle Eigenschaften von Azure AD-Objekten an und kann nicht verwendet werden, um Informationen zu Azure-Ressourcen abzurufen.

• Az PowerShell ist ein Modul zur Verwaltung von Azure-Ressourcen von der PowerShell-Befehlszeile.

Verbindung

az cli

az login #This will open the browser
az login -u <username> -p <password> #Specify user and password
az login --identity #Use the current machine managed identity (metadata)
az login --identity -u /subscriptions/<subscriptionId>/resourcegroups/myRG/providers/Microsoft.ManagedIdentity/userAssignedIdentities/myID #Login with user managed identity
# Login as service principal
az login --service-principal -u http://azure-cli-2016-08-05-14-31-15 -p VerySecret --tenant contoso.onmicrosoft.com #With password
az login --service-principal -u http://azure-cli-2016-08-05-14-31-15 -p ~/mycertfile.pem --tenant contoso.onmicrosoft.com #With cert

# Request access token (ARM)
az account get-access-token
# Request access token for different resource. Supported tokens: aad-graph, arm, batch, data-lake, media, ms-graph, oss-rdbms
az account get-access-token --resource-type aad-graph

# If you want to configure some defaults
az configure

# Get user logged-in already
az ad signed-in-user show

# Help
az find "vm" # Find vm commands
az vm -h # Get subdomains
az ad user list --query-examples # Get examples

Azure AD

Connect-AzureAD #Open browser
# Using credentials
$passwd = ConvertTo-SecureString "Welcome2022!" -AsPlainText -Force
$creds = New-Object System.Management.Automation.PSCredential ("[e-mail]", $passwd)
Connect-AzureAD -Credential $creds

# Using tokens
## AzureAD cannot request tokens, but can use AADGraph and MSGraph tokens to connect
Connect-AzureAD -AccountId [e-mail] -AadAccessToken $token

Az PowerShell

Connect-AzAccount #Open browser
# Using credentials
$passwd = ConvertTo-SecureString "Welcome2022!" -AsPlainText -Force
$creds = New-Object System.Management.Automation.PSCredential("[e-mail]", $passwd)
Connect-AzAccount -Credential $creds

# Get Access Token
(Get-AzAccessToken).Token
# Request access token to other endpoints: AadGraph, AnalysisServices, Arm, Attestation, Batch, DataLake, KeyVault, MSGraph, OperationalInsights, ResourceManager, Storage, Synapse
Get-AzAccessToken -ResourceTypeName MSGraph
(Get-AzAccessToken -Resource "https://graph.microsoft.com").Token

# Conenct with access token
Connect-AzAccount -AccountId [e-mail] -AccessToken $token
Connect-AzAccount -AccessToken $token -GraphAccessToken $graphaccesstoken -AccountId <ACCOUNT-ID>
## The -AccessToken is from management.azure.com

# Connect with Service principal/enterprise app secret
$password = ConvertTo-SecureString 'KWEFNOIRFIPMWL.--DWPNVFI._EDWWEF_ADF~SODNFBWRBIF' -AsPlainText -Force
$creds = New-Object
System.Management.Automation.PSCredential('2923847f-fca2-a420-df10-a01928bec653', $password)
Connect-AzAccount -ServicePrincipal -Credential $creds -Tenant 29sd87e56-a192-a934-bca3-0398471ab4e7d

#All the Azure AD cmdlets have the format *-AzAD*
Get-Command *azad*
#Cmdlets for other Azure resources have the format *Az*
Get-Command *az*

Raw PS

#Using management
$Token = 'eyJ0eXAi..'
# List subscriptions
$URI = 'https://management.azure.com/subscriptions?api-version=2020-01-01'
$RequestParams = @{
Method  = 'GET'
Uri     = $URI
Headers = @{
'Authorization' = "Bearer $Token"
}
}
(Invoke-RestMethod @RequestParams).value

# Using graph
Invoke-WebRequest -Uri "https://graph.windows.net/myorganization/users?api-version=1.6" -Headers @{Authorization="Bearer {0}" -f $Token}

Raw OS

# Request tokens to access endpoints
# ARM
curl "$IDENTITY_ENDPOINT?resource=https://management.azure.com&api-version=2017-09-01" -H secret:$IDENTITY_HEADER

# Vault
curl "$IDENTITY_ENDPOINT?resource=https://vault.azure.net&api-version=2017-09-01" -H secret:$IDENTITY_HEADER

Wenn Sie sich über die CLI bei Azure mit einem beliebigen Programm anmelden, verwenden Sie eine Azure-Anwendung aus einem Mandanten, der zu Microsoft gehört. Diese Anwendungen, wie diejenigen, die Sie in Ihrem Konto erstellen können, haben eine Client-ID. Sie können nicht alle von ihnen in den Listen der zugelassenen Anwendungen sehen, die Sie in der Konsole sehen können, aber sie sind standardmäßig zugelassen.

Zum Beispiel verwendet ein PowerShell-Skript, das sich authentifiziert, eine App mit der Client-ID 1950a258-227b-4e31-a9cf-717495945fc2. Selbst wenn die App nicht in der Konsole angezeigt wird, könnte ein Systemadministrator diese Anwendung blockieren, sodass Benutzer nicht über Tools darauf zugreifen können, die über diese App eine Verbindung herstellen.

Es gibt jedoch andere Client-IDs von Anwendungen, die es Ihnen ermöglichen, eine Verbindung zu Azure herzustellen:

# The important part is the ClientId, which identifies the application to login inside Azure

$token = Invoke-Authorize -Credential $credential `
-ClientId '1dfb5f98-f363-4b0f-b63a-8d20ada1e62d' `
-Scope 'Files.Read.All openid profile Sites.Read.All User.Read email' `
-Redirect_Uri "https://graphtryit-staging.azurewebsites.net/" `
-Verbose -Debug `
-InformationAction Continue

$token = Invoke-Authorize -Credential $credential `
-ClientId '65611c08-af8c-46fc-ad20-1888eb1b70d9' `
-Scope 'openid profile Sites.Read.All User.Read email' `
-Redirect_Uri "chrome-extension://imjekgehfljppdblckcmjggcoboemlah" `
-Verbose -Debug `
-InformationAction Continue

$token = Invoke-Authorize -Credential $credential `
-ClientId 'd3ce4cf8-6810-442d-b42e-375e14710095' `
-Scope 'openid' `
-Redirect_Uri "https://graphexplorer.azurewebsites.net/" `
-Verbose -Debug `
-InformationAction Continue

Benutzer

az cli

# Enumerate users
az ad user list --output table
az ad user list --query "[].userPrincipalName"
# Get info of 1 user
az ad user show --id "[e-mail]"
# Search "admin" users
az ad user list --query "[].displayName" | findstr /i "admin"
az ad user list --query "[?contains(displayName,'admin')].displayName"
# Search attributes containing the word "password"
az ad user list | findstr /i "password" | findstr /v "null,"
# All users from AzureAD
az ad user list --query "[].{osi:onPremisesSecurityIdentifier,upn:userPrincipalName}[?osi==null]"
az ad user list --query "[?onPremisesSecurityIdentifier==null].displayName"
# All users synced from on-prem
az ad user list --query "[].{osi:onPremisesSecurityIdentifier,upn:userPrincipalName}[?osi!=null]"
az ad user list --query "[?onPremisesSecurityIdentifier!=null].displayName"
# Get groups where the user is a member
az ad user get-member-groups --id <email>
# Get roles assigned to the user
az role assignment list --include-groups --include-classic-administrators true --assignee <email>

Azure AD

Azure AD Enumeration

User Enumeration

User enumeration can be performed through the Forgot Password feature on the login page. By entering a valid username, the response will indicate if the user exists or not.

Group Enumeration

Group enumeration can be done by trying to reset the password of a non-existing user and observing the error message. If the group name is included in the error message, it confirms the group's existence.

Application Enumeration

Application enumeration can be carried out by accessing the Azure AD App Gallery or by searching for specific application endpoints. This can reveal information about the applications integrated with Azure AD.

Tenant Enumeration

Tenant enumeration involves identifying the tenant ID, which can be found in various locations such as the issuer claim in JWT tokens or through endpoint URLs.

Domain Enumeration

Domain enumeration can be performed by looking for email addresses associated with the Azure AD tenant. This can provide insights into the domain structure and potentially reveal additional targets for attacks.

Policy Enumeration

Policy enumeration can be done by analyzing the response headers for policies related to password complexity, lockout thresholds, and other security configurations enforced by Azure AD.

Role Enumeration

Role enumeration involves identifying the roles assigned to users within Azure AD. This can be achieved through analyzing user permissions or by looking for role-specific endpoints.

OAuth Scope Enumeration

OAuth scope enumeration can be carried out by analyzing the permissions requested by applications registered in Azure AD. Understanding the scopes can help identify potential security risks associated with excessive permissions.

Device Enumeration

Device enumeration involves identifying devices registered in Azure AD. This can provide insights into the devices used by the organization and potential vulnerabilities related to device management.

Security Defaults Enumeration

Security defaults enumeration involves checking if security defaults are enabled in the Azure AD tenant. This can help identify if basic security configurations recommended by Microsoft are in place.

Conditional Access Enumeration

Conditional access enumeration can be performed by analyzing the conditional access policies configured in Azure AD. Understanding these policies can reveal restrictions and controls applied to user access based on various conditions.

Sign-in Logs Enumeration

Sign-in logs enumeration involves reviewing the sign-in logs recorded by Azure AD. Analyzing these logs can help identify suspicious activities, unauthorized access attempts, or potential security incidents within the Azure AD environment.

Risk Events Enumeration

Risk events enumeration involves analyzing the risk events reported by Azure AD Identity Protection. Understanding these events can help in identifying potential security risks, compromised accounts, or ongoing attacks targeting the Azure AD environment.

MFA Enumeration

MFA enumeration can be carried out by checking if multi-factor authentication is enforced for users in Azure AD. Identifying the MFA settings can provide insights into the additional layer of security implemented for user authentication.

SSPR Enumeration

Self-Service Password Reset (SSPR) enumeration involves checking if users have the option to reset their passwords independently. Understanding the SSPR settings can help assess the password management security within the Azure AD environment.

B2B Enumeration

Business-to-Business (B2B) enumeration involves identifying external users invited to collaborate within the Azure AD tenant. Analyzing the B2B settings can help in understanding the external partnerships and potential security implications of sharing resources with external entities.

B2C Enumeration

Business-to-Consumer (B2C) enumeration involves identifying consumer users registered in the Azure AD B2C directory. Analyzing the B2C settings can provide insights into the customer identity management practices and potential vulnerabilities associated with consumer accounts.

Privileged Identity Management (PIM) Enumeration

Privileged Identity Management (PIM) enumeration involves identifying users with privileged roles and permissions within Azure AD. Analyzing the PIM settings can help in understanding the management of privileged access and potential risks associated with elevated privileges.

Graph API Enumeration

Graph API enumeration can be performed by exploring the Microsoft Graph API endpoints available for interacting with Azure AD data. Understanding the Graph API capabilities can help in leveraging its functionalities for various security assessments and automation tasks.

Legacy Authentication Enumeration

Legacy authentication enumeration involves identifying if legacy authentication protocols are enabled in Azure AD. Analyjson these protocols can help assess the risks associated with outdated authentication mechanisms and potential vulnerabilities in the Azure AD environment.

Federation Enumeration

Federation enumeration involves identifying federated domains and external identity providers configured in Azure AD. Analyzing the federation settings can help understand the trust relationships established for federated authentication and potential security risks associated with federation.

SAML Enumeration

SAML enumeration involves identifying SAML-based applications integrated with Azure AD. Analyzing the SAML settings can help assess the security configurations of SAML integrations and potential vulnerabilities in the authentication process.

SCIM Enumeration

SCIM enumeration involves identifying SCIM-based provisioning integrations in Azure AD. Analyzing the SCIM settings can help understand the automated provisioning processes and potential security implications of SCIM integrations.

API Permissions Enumeration

API permissions enumeration involves reviewing the permissions granted to applications for accessing Azure AD data through APIs. Understanding the API permissions can help assess the data exposure risks and potential impact of compromised applications on Azure AD security.

Application Registration Enumeration

Application registration enumeration involves identifying applications registered in Azure AD and their configurations. Analyzing the application registrations can help identify misconfigurations, security weaknesses, or potential entry points for unauthorized access to Azure AD resources.

Enterprise Application Enumeration

Enterprise application enumeration involves identifying enterprise applications integrated with Azure AD. Analyjson these applications can help understand the external services connected to Azure AD and potential security risks associated with third-party integrations.

User Authentication Enumeration

User authentication enumeration involves analyzing the authentication methods supported by Azure AD for user sign-in. Understanding the authentication options can help assess the security of user authentication processes and identify potential weaknesses in the authentication mechanisms.

User Provisioning Enumeration

User provisioning enumeration involves identifying the methods used for user provisioning in Azure AD. Analyzing the user provisioning settings can help assess the automation processes for user onboarding and offboarding, as well as potential security risks associated with user lifecycle management.

User De-provisioning Enumeration

User de-provisioning enumeration involves identifying the processes for user de-provisioning in Azure AD. Analyjson the de-provisioning mechanisms can help assess the removal of access rights and data associated with user accounts, reducing the risk of unauthorized access to Azure AD resources.

User Attributes Enumeration

User attributes enumeration involves identifying the attributes associated with user accounts in Azure AD. Analyzing the user attributes can help understand the information stored in user profiles, the data collected during user registration, and potential privacy implications related to user data handling.

User Permissions Enumeration

User permissions enumeration involves reviewing the permissions assigned to users within Azure AD. Analyzing the user permissions can help identify excessive privileges, misconfigurations, or potential security risks associated with user access rights.

User Roles Enumeration

User roles enumeration involves identifying the roles assigned to users within Azure AD. Analyzing the user roles can help understand the responsibilities and access levels granted to users, as well as potential risks associated with role-based access control.

User Policies Enumeration

User policies enumeration involves reviewing the policies applied to users within Azure AD. Analyzing the user policies can help assess the security configurations, compliance requirements, and restrictions enforced on user activities within the Azure AD environment.

User Sign-in Enumeration

User sign-in enumeration involves analyzing the sign-in activities of users in Azure AD. Reviewing the user sign-in logs can help identify abnormal sign-in patterns, suspicious activities, or potential security incidents related to user authentication.

User Risk Enumeration

User risk enumeration involves assessing the risk levels associated with user accounts in Azure AD. Analyzing the user risk scores can help prioritize security measures, identify compromised accounts, or mitigate potential threats posed by risky user behavior.

User Security Info Enumeration

User security info enumeration involves reviewing the security information associated with user accounts in Azure AD. Analyzing the user security info can help assess the account recovery options, multi-factor authentication settings, and security configurations implemented for user accounts.

User Session Enumeration

User session enumeration involves analyzing the active sessions of users in Azure AD. Reviewing the user session data can help identify unauthorized access, active login sessions, or potential security breaches related to user sessions.

User Activity Enumeration

User activity enumeration involves reviewing the activity logs of users in Azure AD. Analyzing the user activity data can help track user actions, monitor changes made by users, and detect suspicious behavior or policy violations within the Azure AD environment.

User Sign-up Enumeration

User sign-up enumeration involves identifying the processes for user registration in Azure AD. Analyzing the user sign-up methods can help understand the account creation workflows, validation processes, and potential security risks associated with user registration.

User Verification Enumeration

User verification enumeration involves assessing the methods used for verifying user identities in Azure AD. Analyzing the user verification options can help evaluate the security of user authentication processes, prevent unauthorized access, and enhance the overall identity verification mechanisms.

User Licensing Enumeration

User licensing enumeration involves reviewing the licensing information associated with user accounts in Azure AD. Analyzing the user licensing data can help manage license assignments, track subscription usage, and ensure compliance with licensing agreements within the Azure AD environment.

User Reporting Enumeration

User reporting enumeration involves generating reports on user activities and configurations in Azure AD. Analyzing the user reporting data can help monitor user behavior, track account usage, and identify security incidents or compliance issues within the Azure AD environment.

User Integration Enumeration

User integration enumeration involves identifying the integration methods used for connecting user accounts with external systems or applications in Azure AD. Analyzing the user integration settings can help understand data flows, access controls, and potential security risks associated with user data sharing.

User Migration Enumeration

User migration enumeration involves assessing the processes for migrating user accounts between different Azure AD environments or directories. Analyzing the user migration options can help ensure data consistency, user access continuity, and security compliance during migration activities.

User Sync Enumeration

User sync enumeration involves synchronizing user account data between on-premises directories and Azure AD. AnalyAnalyzing the user sync processes can help maintain data consistency, streamline user management, and ensure accurate user information across integrated systems.

User Monitoring Enumeration

User monitoring enumeration involves monitoring user activities, sign-in events, and access patterns in Azure AD. Analyzing the user monitoring data can help detect anomalies, identify security threats, and respond to incidents affecting user accounts or Azure AD resources.

User Compliance Enumeration

User compliance enumeration involves assessing the compliance status of user accounts in Azure AD. Analyzing the user compliance data can help ensure adherence to regulatory requirements, security standards, and internal policies governing user access and data handling within the Azure AD environment.

User Governance Enumeration

User governance enumeration involves establishing governance frameworks for managing user identities and access permissions in Azure AD. Analyzing the user governance policies can help enforce security controls, streamline user provisioning processes, and maintain compliance with identity management best practices.

User Privacy Enumeration

User privacy enumeration involves evaluating the privacy settings and data protection measures applied to user accounts in Azure AD. Analyzing the user privacy configurations can help protect sensitive information, address privacy concerns, and ensure compliance with data protection regulations within the Azure AD environment.

User Encryption Enumeration

User encryption enumeration involves assessing the encryption mechanisms used to protect user data in Azure AD. Analyzing the user encryption methods can help safeguard sensitive information, prevent data breaches, and enhance the overall security of user data stored in Azure AD.

User Access Enumeration

User access enumeration involves reviewing the access rights granted to users within Azure AD. Analyzing the user access permissions can help identify unauthorized access, enforce least privilege principles, and mitigate security risks associated with excessive user permissions.

User Authentication Enumeration

User authentication enumeration involves analyzing the authentication methods supported by Azure AD for user sign-in. Understanding the authentication options can help assess the security of user authentication processes and identify potential weaknesses in the authentication mechanisms.

User Provisioning Enumeration

User provisioning enumeration involves identifying the methods used for user provisioning in Azure AD. Analyzing the user provisioning settings can help assess the automation processes for user onboarding and offboarding, as well as potential security risks associated with user lifecycle management.

User De-provisioning Enumeration

User de-provisioning enumeration involves identifying the processes for user de-provisioning in Azure AD. AnalyAnalyzing the de-provisioning mechanisms can help assess the removal of access rights and data associated with user accounts, reducing the risk of unauthorized access to Azure AD resources.

User Attributes Enumeration

User attributes enumeration involves identifying the attributes associated with user accounts in Azure AD. Analyzing the user attributes can help understand the information stored in user profiles, the data collected during user registration, and potential privacy implications related to user data handling.

User Permissions Enumeration

User permissions enumeration involves reviewing the permissions assigned to users within Azure AD. Analyzing the user permissions can help identify excessive privileges, misconfigurations, or potential security risks associated with user access rights.

User Roles Enumeration

User roles enumeration involves identifying the roles assigned to users within Azure AD. Analyzing the user roles can help understand the responsibilities and access levels granted to users, as well as potential risks associated with role-based access control.

User Policies Enumeration

User policies enumeration involves reviewing the policies applied to users within Azure AD. Analyzing the user policies can help assess the security configurations, compliance requirements, and restrictions enforced on user activities within the Azure AD environment.

User Sign-in Enumeration

User sign-in enumeration involves analyzing the sign-in activities of users in Azure AD. Reviewing the user sign-in logs can help identify abnormal sign-in patterns, suspicious activities, or potential security incidents related to user authentication.

User Risk Enumeration

User risk enumeration involves assessing the risk levels associated with user accounts in Azure AD. Analyzing the user risk scores can help prioritize security measures, identify compromised accounts, or mitigate potential threats posed by risky user behavior.

User Security Info Enumeration

User security info enumeration involves reviewing the security information associated with user accounts in Azure AD. Analyzing the user security info can help assess the account recovery options, multi-factor authentication settings, and security configurations implemented for user accounts.

User Session Enumeration

User session enumeration involves analyzing the active sessions of users in Azure AD. Reviewing the user session data can help identify unauthorized access, active login sessions, or potential security breaches related to user sessions.

User Activity Enumeration

User activity enumeration involves reviewing the activity logs of users in Azure AD. Analyzing the user activity data can help track user actions, monitor changes made by users, and detect suspicious behavior or policy violations within the Azure AD environment.

User Sign-up Enumeration

User sign-up enumeration involves identifying the processes for user registration in Azure AD. Analyzing the user sign-up methods can help understand the account creation workflows, validation processes, and potential security risks associated with user registration.

User Verification Enumeration

User verification enumeration involves assessing the methods used for verifying user identities in Azure AD. Analyzing the user verification options can help evaluate the security of user authentication processes, prevent unauthorized access, and enhance the overall identity verification mechanisms.

User Licensing Enumeration

User licensing enumeration involves reviewing the licensing information associated with user accounts in Azure AD. Analyzing the user licensing data can help manage license assignments, track subscription usage, and ensure compliance with licensing agreements within the Azure AD environment.

User Reporting Enumeration

User reporting enumeration involves generating reports on user activities and configurations in Azure AD. Analyzing the user reporting data can help monitor user behavior, track account usage, and identify security incidents or compliance issues within the Azure AD environment.

User Integration Enumeration

User integration enumeration involves identifying the integration methods used for connecting user accounts with external systems or applications in Azure AD. Analyzing the user integration settings can help understand data flows, access controls, and potential security risks associated with user data sharing.

User Migration Enumeration

User migration enumeration involves assessing the processes for migrating user accounts between different Azure AD environments or directories. Analyzing the user migration options can help ensure data consistency, user access continuity, and security compliance during migration activities.

User Sync Enumeration

User sync enumeration involves synchronizing user account data between on-premises directories and Azure AD. AnalyAnalyzing the user sync processes can help maintain data consistency, streamline user management, and ensure accurate user information across integrated systems.

User Monitoring Enumeration

User monitoring enumeration involves monitoring user activities, sign-in events, and access patterns in Azure AD. Analyzing the user monitoring data can help detect anomalies, identify security threats, and respond to incidents affecting user accounts or Azure AD resources.

User Compliance Enumeration

User compliance enumeration involves assessing the compliance status of user accounts in Azure AD. Analyzing the user compliance data can help ensure adherence to regulatory requirements, security standards, and internal policies governing user access and data handling within the Azure AD environment.

User Governance Enumeration

User governance enumeration involves establishing governance frameworks for managing user identities and access permissions in Azure AD. Analyzing the user governance policies can help enforce security controls, streamline user provisioning processes, and maintain compliance with identity management best practices.

User Privacy Enumeration

User privacy enumeration involves evaluating the privacy settings and data protection measures applied to user accounts in Azure AD. Analyzing the user privacy configurations can help protect sensitive information, address privacy concerns, and ensure compliance with data protection regulations within the Azure AD environment.

User Encryption Enumeration

User encryption enumeration involves assessing the encryption mechanisms used to protect user data in Azure AD. Analyzing the user encryption methods can help safeguard sensitive information, prevent data breaches, and enhance the overall security of user data stored in Azure AD.

User Access Enumeration

User access enumeration involves reviewing the access rights granted to users within Azure AD. Analyzing the user access permissions can help identify unauthorized access, enforce least privilege principles, and mitigate security risks associated with excessive user permissions.

User Authentication Enumeration

User authentication enumeration involves analyzing the authentication methods supported by Azure AD for user sign-in. Understanding the authentication options can help assess the security of user authentication processes and identify potential weaknesses in the authentication mechanisms.

User Provisioning Enumeration

User provisioning enumeration involves identifying the methods used for user provisioning in Azure AD. Analyzing the user provisioning settings can help assess the automation processes for user onboarding and offboarding, as well as potential security risks associated with user lifecycle management.

User De-provisioning Enumeration

User de-provisioning enumeration involves identifying the processes for user de-provisioning in Azure AD. AnalyAnalyzing the de-provisioning mechanisms can help assess the removal of access rights and data associated with user accounts, reducing the risk of unauthorized access to Azure AD resources.

User Attributes Enumeration

User attributes enumeration involves identifying the attributes associated with user accounts in Azure AD. Analyzing the user attributes can help understand the information stored in user profiles, the data collected during user registration, and potential privacy implications related to user data handling.

User Permissions Enumeration

User permissions enumeration involves reviewing the permissions assigned to users within Azure AD. Analyzing the user permissions can help identify excessive privileges, misconfigurations, or potential security risks associated with user access rights.

User Roles Enumeration

User roles enumeration involves identifying the roles assigned to users within Azure AD. Analyzing the user roles can help understand the responsibilities and access levels granted to users, as well as potential risks associated with role-based access control.

User Policies Enumeration

User policies enumeration involves reviewing the policies applied to users within Azure AD. Analyzing the user policies can help assess the security configurations, compliance requirements, and restrictions enforced on user activities within the Azure AD environment.

User Sign-in Enumeration

User sign-in enumeration involves analyzing the sign-in activities of users in Azure AD. Reviewing the user sign-in logs can help identify abnormal sign-in patterns, suspicious activities, or potential security incidents related to user authentication.

User Risk Enumeration

User risk enumeration involves assessing the risk levels associated with user accounts in Azure AD. Analyzing the user risk scores can help prioritize security measures, identify compromised accounts, or mitigate potential threats posed by risky user behavior.

User Security Info Enumeration

User security info enumeration involves reviewing the security information associated with user accounts in Azure AD. Analyzing the user security info can help assess the account recovery options, multi-factor authentication settings, and security configurations implemented for user accounts.

User Session Enumeration

User session enumeration involves analyzing the

# Enumerate Users
Get-AzureADUser -All $true
Get-AzureADUser -All $true | select UserPrincipalName
# Get info of 1 user
Get-AzureADUser -ObjectId [e-mail] | fl
# Search "admin" users
Get-AzureADUser -SearchString "admin" #Search admin at the begining of DisplayName or userPrincipalName
Get-AzureADUser -All $true |?{$_.Displayname -match "admin"} #Search "admin" word in DisplayName
# Get all attributes of a user
Get-AzureADUser -ObjectId [e-mail]|%{$_.PSObject.Properties.Name}
# Search attributes containing the word "password"
Get-AzureADUser -All $true |%{$Properties = $_;$Properties.PSObject.Properties.Name | % {if ($Properties.$_ -match 'password') {"$($Properties.UserPrincipalName) - $_ - $($Properties.$_)"}}}
# All users from AzureAD# All users from AzureAD
Get-AzureADUser -All $true | ?{$_.OnPremisesSecurityIdentifier -eq $null}
# All users synced from on-prem
Get-AzureADUser -All $true | ?{$_.OnPremisesSecurityIdentifier -ne $null}
# Objects created by a/any user
Get-AzureADUser [-ObjectId <email>] | Get-AzureADUserCreatedObject
# Devices owned by a user
Get-AzureADUserOwnedDevice -ObjectId [e-mail]
# Objects owned by a specific user
Get-AzureADUserOwnedObject -ObjectId [e-mail]
# Get groups & roles where the user is a member
Get-AzureADUserMembership -ObjectId '[e-mail]'
# Get devices owned by a user
Get-AzureADUserOwnedDevice -ObjectId [e-mail]
# Get devices registered by a user
Get-AzureADUserRegisteredDevice -ObjectId [e-mail]
# Apps where a user has a role (role not shown)
Get-AzureADUser -ObjectId [e-mail] | Get-AzureADUserAppRoleAssignment | fl *
# Get Administrative Units of a user
$userObj = Get-AzureADUser -Filter "UserPrincipalName eq '[e-mail]'"
Get-AzureADMSAdministrativeUnit | where { Get-AzureADMSAdministrativeUnitMember -Id $_.Id | where { $_.Id -eq $userObj.ObjectId } }

Az PowerShell

Azure AD Connect Health

Azure AD Connect Health ist ein Dienst, der die Überwachung und Benachrichtigung über die Integrität von Azure AD Connect ermöglicht. Es bietet detaillierte Einblicke in die Synchronisierungsgesundheit, einschließlich Warnungen und Benachrichtigungen bei Problemen. Mit Azure AD Connect Health können Administratoren die Leistung überwachen und Probleme schnell beheben.

# Enumerate users
Get-AzADUser
# Get details of a user
Get-AzADUser -UserPrincipalName [e-mail]
# Search user by string
Get-AzADUser -SearchString "admin" #Search at the beginnig of DisplayName
Get-AzADUser | ?{$_.Displayname -match "admin"}
# Get roles assigned to a user
Get-AzRoleAssignment -SignInName [e-mail]

Passwort des Benutzers ändern

$password = "ThisIsTheNewPassword.!123" | ConvertTo- SecureString -AsPlainText –Force

(Get-AzureADUser -All $true | ?{$_.UserPrincipalName -eq "[e-mail]"}).ObjectId | Set- AzureADUserPassword -Password $password –Verbose

MFA & Bedingte Zugriffsrichtlinien

Es wird dringend empfohlen, MFA für jeden Benutzer hinzuzufügen. Einige Unternehmen setzen es jedoch möglicherweise nicht oder aktivieren es mit einer bedingten Zugriffsrichtlinie: Der Benutzer wird zur MFA-Eingabe aufgefordert, wenn er sich von einem bestimmten Standort, Browser oder unter bestimmten Bedingungen aus anmeldet. Diese Richtlinien sind anfällig für Umgehungen, wenn sie nicht korrekt konfiguriert sind. Überprüfen Sie:

Az - Conditional Access Policies / MFA Bypass

Gruppen

# Enumerate groups
az ad group list
az ad group list --query "[].[displayName]" -o table
# Get info of 1 group
az ad group show --group <group>
# Get "admin" groups
az ad group list --query "[].displayName" | findstr /i "admin"
az ad group list --query "[?contains(displayName,'admin')].displayName"
# All groups from AzureAD
az ad group list --query "[].{osi:onPremisesSecurityIdentifier,displayName:displayName,description:description}[?osi==null]"
az ad group list --query "[?onPremisesSecurityIdentifier==null].displayName"
# All groups synced from on-prem
az ad group list --query "[].{osi:onPremisesSecurityIdentifier,displayName:displayName,description:description}[?osi!=null]"
az ad group list --query "[?onPremisesSecurityIdentifier!=null].displayName"
# Get members of group
az ad group member list --group <group> --query "[].userPrincipalName" -o table
# Check if member of group
az ad group member check --group "VM Admins" --member-id <id>
# Get which groups a group is member of
az ad group get-member-groups -g "VM Admins"
# Get Apps where a group has a role (role not shown)
Get-AzureADGroup -ObjectId <id> | Get-AzureADGroupAppRoleAssignment | fl *

Azure AD Enumeration

User Enumeration

User enumeration can be performed through the login interface by identifying different responses for valid and invalid users.

Tools

• Azure AD Internals: A tool that can be used to enumerate users in Azure AD.

Group Enumeration

Group enumeration can be performed by identifying the response when requesting information about a specific group.

Tools

• Azure AD Internals: This tool can also be used to enumerate groups in Azure AD.

Application Enumeration

Application enumeration involves identifying applications registered in Azure AD.

Tools

• Azure AD Internals: This tool can help enumerate applications registered in Azure AD.

Device Enumeration

Device enumeration involves identifying devices registered in Azure AD.

Tools

• Azure AD Internals: This tool can assist in enumerating devices registered in Azure AD.

Service Principal Enumeration

Service principal enumeration involves identifying service principals in Azure AD.

Tools

• Azure AD Internals: Thisjson tool can be used to enumerate service principals in Azure AD.

Tenant Enumeration

Tenant enumeration involves identifying the tenant ID and tenant domain in Azure AD.

Tools

• Azure AD Internals: This tool can be used to enumerate tenant information in Azure AD.

Domain Enumeration

Domain enumeration involves identifying the domains associated with the Azure AD tenant.

Tools

• Azure AD Internals: This tool can help enumerate domains associated with the Azure AD tenant.

Policy Enumeration

Policy enumeration involves identifying the policies configured in Azure AD.

Tools

• Azure AD Internals: This tool can assist in enumerating policies configured in Azure AD.

Role Enumeration

Role enumeration involves identifying the roles assigned in Azure AD.

Tools

• Azure AD Internals: This tool can be used to enumerate roles assigned in Azure AD.

Certificate Enumeration

Certificate enumeration involves identifying certificates registered in Azure AD.

Tools

• Azure AD Internals: This tool can help enumerate certificates registered in Azure AD.

Key Enumeration

Key enumeration involves identifying keys registered in Azure AD.

Tools

• Azure AD Interntools: This tool can assist in enumerating keys registered in Azure AD.

Application Registration Enumeration

Application registration enumeration involves identifying applications registered in Azure AD.

Tools

• Azure AD Internals: This tool can help enumerate applications registered in Azure AD.

OAuth2 Permission Enumeration

OAuth2 permission enumeration involves identifying OAuth2 permissions granted in Azure AD.

Tools

• Azure AD Internals: Thisthis tool can be used to enumerate OAuth2 permissions granted in Azure AD.

App Registration Enumeration

App registration enumeration involves identifying applications registered in Azure AD.

Tools

• Azure AD Internals: This tool can help enumerate applications registered in Azure AD.

App Role Enumeration

App role enumeration involves identifying app roles assigned in Azure AD.

Tools

• Azure AD Internals: This tool can be used to enumerate app roles assigned in Azure AD.

App Secret Enumeration

App secret enumeration involves identifying application secrets in Azure AD.

Tools

• Azure AD Internals: This tool can assist in enumerating application secrets in Azure AD.

App Credential Enumeration

App credential enumeration involves identifying application credentials in Azure AD.

Tools

• Azure AD Internals: This tool can help enumerate application credentials in Azure AD.

App Permission Enumeration

App permission enumeration involves identifying application permissions in Azure AD.

Tools

• Azure AD Internals: This tool can be used to enumerate application permissions in Azure AD.

App Cert Enumeration

App cert enumeration involves identifying application certificates in Azure AD.

Tools

• Azure AD Internals: This tool can assist in enumerating application certificates in Azure AD.

App Key Enumeration

App key enumeration involves identifying application keys in Azure AD.

Tools

• Azure AD Internals: This tool can help enumerate application keys in Azure AD.

App Federation Enumeration

App federation enumeration involves identifying application federations in Azure AD.

Tools

• Azure AD Internals: This tool can be used to enumerate application federations in Azure AD.

App SAML Enumeration

App SAML enumeration involves identifying SAML configurations in Azure AD.

Tools

• Azure AD Internals: This tool can assist in enumerating SAML configurations in Azure AD.

App OpenID Enumeration

App OpenID enumeration involves identifying OpenID configurations in Azure AD.

Tools

• Azure AD Internals: This tool can help enumerate OpenID configurations in Azure AD.

App Oauth2 Enumeration

App OAuth2 enumeration involves identifying OAuth2 configurations in Azure AD.

Tools

• Azure AD Internals: This tool can be used to enumerate OAuth2 configurations in Azure AD.

App Graph Enumeration

App Graph enumeration involves identifying Microsoft Graph configurations in Azure AD.

Tools

• Azure AD Internals: This tool can assist in enumerating Microsoft Graph configurations in Azure AD.

App API Enumeration

App API enumeration involves identifying API configurations in Azure AD.

Tools

• Azure AD Internals: This tool can help enumerate API configurations in Azure AD.

App Delegation Enumeration

App delegation enumeration involves identifying delegation configurations in Azure AD.

Tools

• Azure AD Internals: This tool can be used to enumerate delegation configurations in Azure AD.

App User Enumeration

App user enumeration involves identifying user configurations in Azure AD.

Tools

• Azure AD Internals: This tool can assist in enumerating user configurations in Azure AD.

App Group Enumeration

App group enumeration involves identifying group configurations in Azure AD.

Tools

• Azure AD Internals: This tool can help enumerate group configurations in Azure AD.

App Device Enumeration

App device enumeration involves identifying device configurations in Azure AD.

Tools

• Azure AD Internals: Thisthis tool can be used to enumerate device configurations in Azure AD.

App Service Principal Enumeration

App service principal enumeration involves identifying service principal configurations in Azure AD.

Tools

• Azure AD Internals: This tool can assist in enumerating service principal configurations in Azure AD.

App Tenant Enumeration

App tenant enumeration involves identifying tenant configurations in Azure AD.

Tools

• Azure AD Internals: This tool can help enumerate tenant configurations in Azure AD.

App Domain Enumeration

App domain enumeration involves identifying domain configurations in Azure AD.

Tools

• Azure AD Internals: This tool can be used to enumerate domain configurations in Azure AD.

App Policy Enumeration

App policy enumeration involves identifying policy configurations in Azure AD.

Tools

• Azure AD Internals: This tool can assist in enumerating policy configurations in Azure AD.

App Role Enumeration

App role enumeration involves identifying role configurations in Azure AD.

Tools

• Azure AD Internals: This tool can be used to enumerate role configurations in Azure AD.

App Certificate Enumeration

App certificate enumeration involves identifying certificate configurations in Azure AD.

Tools

• Azure AD Internals: This tool can help enumerate certificate configurations in Azure AD.

App Key Enumeration

App key enumeration involves identifying key configurations in Azure AD.

Tools

• Azure AD Internals: This tool can assist in enumerating key configurations in Azure AD.

App OAuth2 Permission Enumeration

App OAuth2 permission enumeration involves identifying OAuth2 permission configurations in Azure AD.

Tools

• Azure AD Internals: This tool can help enumerate OAuth2 permission configurations in Azure AD.

App Federation Enumeration

App federation enumeration involves identifying federation configurations in Azure AD.

Tools

• Azure AD Internals: This tool can be used to enumerate federation configurations in Azure AD.

App SAML Enumeration

App SAML enumeration involves identifying SAML configurations in Azure AD.

Tools

• Azure AD Internals: This tool can assist in enumerating SAML configurations in Azure AD.

App OpenID Enumeration

App OpenID enumeration involves identifying OpenID configurations in Azure AD.

Tools

• Azure AD Internals: This tool can help enumerate OpenID configurations in Azure AD.

App OAuth2 Enumeration

App OAuth2 enumeration involves identifying OAuth2 configurations in Azure AD.

Tools

• Azure AD Internals: This tool can be used to enumerate OAuth2 configurations in Azure AD.

App Graph Enumeration

App Graph enumeration involves identifying Microsoft Graph configurations in Azure AD.

Tools

• Azure AD Internals: This tool can assist in enumerating Microsoft Graph configurations in Azure AD.

App API Enumeration

App API enumeration involves identifying API configurations in Azure AD.

Tools

• Azure AD Internals: This tool can help enumerate API configurations in Azure AD.

App Delegation Enumeration

App delegation enumeration involves identifying delegation configurations in Azure AD.

Tools

• Azure AD Internals: This tool can be used to enumerate delegation configurations in Azure AD.

App User Enumeration

App user enumeration involves identifying user configurations in Azure AD.

Tools

• Azure AD Internals: This tool can assist in enumerating user configurations in Azure AD.

App Group Enumeration

App group enumeration involves identifying group configurations in Azure AD.

Tools

• Azure AD Internals: This tool can help enumerate group configurations in Azure AD.

App Device Enumeration

App device enumeration involves identifying device configurations in Azure AD.

Tools

• Azure AD Internals: This tool can be used to enumerate device configurations in Azure AD.

App Service Principal Enumeration

App service principal enumeration involves identifying service principal configurations in Azure AD.

Tools

• Azure AD Internals: This tool can assist in enumerating service principal configurations in Azure AD.

App Tenant Enumeration

App tenant enumeration involves identifying tenant configurations in Azure AD.

Tools

• Azure AD Internals: This tool can help enumerate tenant configurations in Azure AD.

App Domain Enumeration

App domain enumeration involves identifying domain configurations in Azure AD.

Tools

• Azure AD Internals: This tool can be used to enumerate domain configurations in Azure AD.

App Policy Enumeration

App policy enumeration involves identifying policy configurations in Azure AD.

Tools

• Azure AD Internals: This tool can assist in enumerating policy configurations in Azure AD.

App Role Enumeration

App role enumeration involves identifying role configurations in Azure AD.

Tools

• Azure AD Internals: This tool can be used to enumerate role configurations in Azure AD.

App Certificate Enumeration

App certificate enumeration involves identifying certificate configurations in Azure AD.

Tools

• Azure AD Internals: This tool can help enumerate certificate configurations in Azure AD.

App Key Enumeration

App key enumeration involves identifying key configurations in Azure AD.

Tools

• Azure AD Internals: This tool can assist in enumerating key configurations in Azure AD.

App OAuth2 Permission Enumeration

App OAuth2 permission enumeration involves identifying OAuth2 permission configurations in Azure AD.

Tools

• Azure AD Internals: This tool can help enumerate OAuth2 permission configurations in Azure AD.

App Federation Enumeration

App federation enumeration involves identifying federation configurations in Azure AD.

Tools

• Azure AD Internals: This tool can be used to enumerate federation configurations in Azure AD.

App SAML Enumeration

App SAML enumeration involves identifying SAML configurations in Azure AD.

Tools

• Azure AD Internals: This tool can assist in enumerating SAML configurations in Azure AD.

App OpenID Enumeration

App OpenID enumeration involves identifying OpenID configurations in Azure AD.

Tools

• Azure AD Internals: This tool can help enumerate OpenID configurations in Azure AD.

App OAuth2 Enumeration

App OAuth2 enumeration involves identifying OAuth2 configurations in Azure AD.

Tools

• Azure AD Internals: This tool can be used to enumerate OAuth2 configurations in Azure AD.

App Graph Enumeration

App Graph enumeration involves identifying Microsoft Graph configurations in Azure AD.

Tools

• Azure AD Internals: This tool can assist in enumerating Microsoft Graph configurations in Azure AD.

App API Enumeration

App API enumeration involves identifying API configurations in Azure AD.

Tools

• Azure AD Internals: This tool can help enumerate API configurations in Azure AD.

App Delegation Enumeration

App delegation enumeration involves identifying delegation configurations in Azure AD.

Tools

• Azure AD Internals: This tool can be used to enumerate delegation configurations in Azure AD.

App User Enumeration

App user enumeration involves identifying user configurations in Azure AD.

Tools

• Azure AD Internals: This tool can assist in enumerating user configurations in Azure AD.

App Group Enumeration

App group enumeration involves identifying group configurations in Azure AD.

Tools

• Azure AD Internals: This tool can help enumerate group configurations in Azure AD.

App Device Enumeration

App device enumeration involves identifying device configurations in Azure AD.

Tools

• Azure AD Internals: This tool can be used to enumerate device configurations in Azure AD.

App Service Principal Enumeration

App service principal enumeration involves identifying service principal configurations in Azure AD.

Tools

• Azure AD Internals: This tool can assist in enumerating service principal configurations in Azure AD.

App Tenant Enumeration

App tenant enumeration involves identifying tenant configurations in Azure AD.

Tools

• Azure AD Internals: This tool can help enumerate tenant configurations in Azure AD.

App Domain Enumeration

App domain enumeration involves identifying domain configurations in Azure AD.

Tools

• Azure AD Internals: This tool can be used to enumerate domain configurations in Azure AD.

App Policy Enumeration

App policy enumeration involves identifying policy configurations in Azure AD.

Tools

• Azure AD Internals: This tool can assist in enumerating policy configurations in Azure AD.

App Role Enumeration

App role enumeration involves identifying role configurations in Azure AD.

Tools

• Azure AD Internals: This tool can be used to enumerate role configurations in Azure AD.

App Certificate Enumeration

App certificate enumeration involves identifying certificate configurations in Azure AD.

Tools

• Azure AD Internals: This tool can help enumerate certificate configurations in Azure AD.

App Key Enumeration

App key enumeration involves identifying key configurations in Azure AD.

Tools

• Azure AD Internals: This tool can assist in enumerating key configurations in Azure AD.

App OAuth2 Permission Enumeration

App OAuth2 permission enumeration involves identifying OAuth2 permission configurations in Azure AD.

Tools

• Azure AD Internals: This tool can help enumerate OAuth2 permission configurations in Azure AD.

App Federation Enumeration

App federation enumeration involves identifying federation configurations in Azure AD.

Tools

• Azure AD Internals: This tool can be used to enumerate federation configurations in Azure AD.

App SAML Enumeration

App SAML enumeration involves identifying SAML configurations in Azure AD.

Tools

• Azure AD Internals: This tool can assist in enumerating SAML configurations in Azure AD.

App OpenID Enumeration

App OpenID enumeration involves identifying OpenID configurations in Azure AD.

Tools

• Azure AD Internals: This tool can help enumerate OpenID configurations in Azure AD.

App OAuth2 Enumeration

App OAuth2 enumeration involves identifying OAuth2 configurations in Azure AD.

Tools

• Azure AD Internals: This tool can be used to enumerate OAuth2 configurations in Azure AD.

App Graph Enumeration

App Graph enumeration involves identifying Microsoft Graph configurations in Azure AD.

Tools

• Azure AD Internals: This tool can assist in enumerating Microsoft Graph configurations in Azure AD.

App API Enumeration

App API enumeration involves identifying API configurations in Azure AD.

Tools

• Azure AD Internals: This tool can help enumerate API configurations in Azure AD.

App Delegation Enumeration

App delegation enumeration involves identifying delegation configurations in Azure AD.

Tools

• Azure AD Internals: This tool can be used to enumerate delegation configurations in Azure AD.

App User Enumeration

App user enumeration involves identifying user configurations in Azure AD.

Tools

• Azure AD Internals: This tool can assist in enumerating user configurations in Azure AD.

App Group Enumeration

App group enumeration involves identifying group configurations in Azure AD.

Tools

• Azure AD Internals: This tool can help enumerate group configurations in Azure AD.

App Device Enumeration

App device enumeration involves identifying device configurations in Azure AD.

Tools

• Azure AD Internals: This tool can be used to enumerate device configurations in Azure AD.

App Service Principal Enumeration

App service principal enumeration involves identifying service principal configurations in Azure AD.

Tools

• Azure AD Internals: This tool can assist in enumerating service principal configurations in Azure AD.

App Tenant Enumeration

App tenant enumeration involves identifying tenant configurations in Azure AD.

Tools

• Azure AD Internals: This tool can help enumerate tenant configurations in Azure AD.

App Domain Enumeration

App domain enumeration involves identifying domain configurations in Azure AD.

Tools

• Azure AD Internals: This tool can be used to enumerate domain configurations in Azure AD.

App Policy Enumeration

App policy enumeration involves identifying policy configurations in Azure AD.

Tools

• Azure AD Internals: This tool can assist in enumerating policy configurations in Azure AD.

App Role Enumeration

App role enumeration involves identifying role configurations in Azure AD.

Tools

• Azure AD Internals: This tool can be used to enumerate role configurations in Azure AD.

App Certificate Enumeration

App certificate enumeration involves identifying certificate configurations in Azure AD.

Tools

• Azure AD Internals: This tool can help enumerate certificate configurations in Azure AD.

App Key Enumeration

App key enumeration involves identifying key configurations in Azure AD.

Tools

• Azure AD Internals: This tool can assist in enumerating key configurations in Azure AD.

App OAuth2 Permission Enumeration

App OAuth2 permission enumeration involves identifying OAuth2 permission configurations in Azure AD.

Tools

• Azure AD Internals: This tool can help enumerate OAuth2 permission configurations in Azure AD.

App Federation Enumeration

App federation enumeration involves identifying federation configurations in Azure AD.

Tools

• Azure AD Internals: This tool can be used to enumerate federation configurations in Azure AD.

App SAML Enumeration

App SAML enumeration involves identifying SAML configurations in Azure AD.

Tools

• Azure AD Internals: This tool can assist in enumerating SAML configurations in Azure AD.

App OpenID Enumeration

App OpenID enumeration involves identifying OpenID configurations in Azure AD.

Tools

• Azure AD Internals: This tool can help enumerate OpenID configurations in Azure AD.

App OAuth2 Enumeration

App OAuth2 enumeration involves identifying OAuth2 configurations in Azure AD.

Tools

• Azure AD Internals: This tool can be used to enumerate OAuth2 configurations in Azure AD.

App Graph Enumeration

App Graph enumeration involves identifying Microsoft Graph configurations in Azure AD.

Tools

• Azure AD Internals: This tool can assist in enumerating Microsoft Graph configurations in Azure AD.

App API Enumeration

App API enumeration involves identifying API configurations in Azure AD.

Tools

• Azure AD Internals: This tool can help enumerate API configurations in Azure AD.

App Delegation Enumeration

App delegation enumeration involves identifying delegation configurations in Azure AD.

Tools

• Azure AD Internals: This tool can be used to enumerate delegation configurations in Azure AD.

App User Enumeration

App user enumeration involves identifying user configurations in Azure AD.

Tools

• Azure AD Internals: This tool can assist in enumerating user configurations in Azure AD.

App Group Enumeration

App group enumeration involves identifying group configurations in Azure AD.

Tools

• Azure AD Internals: This tool can help enumerate group configurations in Azure AD.

App Device Enumeration

App device enumeration involves identifying device configurations in Azure AD.

Tools

• Azure AD Internals: This tool can be used to enumerate device configurations in Azure AD.

App Service Principal Enumeration

App service principal enumeration involves identifying service principal configurations in Azure AD.

Tools

# Enumerate Groups
Get-AzureADGroup -All $true
# Get info of 1 group
Get-AzADGroup -DisplayName <resource_group_name> | fl
# Get "admin" groups
Get-AzureADGroup -SearchString "admin" | fl #Groups starting by "admin"
Get-AzureADGroup -All $true |?{$_.Displayname -match "admin"} #Groups with the word "admin"
# Get groups allowing dynamic membership
Get-AzureADMSGroup | ?{$_.GroupTypes -eq 'DynamicMembership'}
# All groups that are from Azure AD
Get-AzureADGroup -All $true | ?{$_.OnPremisesSecurityIdentifier -eq $null}
# All groups that are synced from on-prem (note that security groups are not synced)
Get-AzureADGroup -All $true | ?{$_.OnPremisesSecurityIdentifier -ne $null}
# Get members of a group
Get-AzureADGroupMember -ObjectId <group_id>
# Get roles of group
Get-AzureADMSGroup -SearchString "Contoso_Helpdesk_Administrators" #Get group id
Get-AzureADMSRoleAssignment -Filter "principalId eq '69584002-b4d1-4055-9c94-320542efd653'"
# Get Administrative Units of a group
$groupObj = Get-AzureADGroup -Filter "displayname eq 'TestGroup'"
Get-AzureADMSAdministrativeUnit | where { Get-AzureADMSAdministrativeUnitMember -Id $_.Id | where {$_.Id -eq $groupObj.ObjectId} }

Azure AD-Identitäten und -Gruppen

Überblick

Azure AD-Identitäten und -Gruppen sind wichtige Elemente, die in Azure AD verwaltet werden. Identitäten können Benutzer oder Anwendungen darstellen, während Gruppen eine Sammlung von Benutzern oder Anwendungen sind. In diesem Abschnitt werden verschiedene Azure PowerShell-Befehle vorgestellt, die bei der Verwaltung von Identitäten und Gruppen in Azure AD helfen.

Identitäten verwalten

Benutzeridentitäten

Um Benutzeridentitäten mithilfe von Azure PowerShell zu verwalten, können Befehle wie New-AzADUser, Get-AzADUser, Set-AzADUser und Remove-AzADUser verwendet werden.

# Beispiel: Neuen Benutzer erstellen
New-AzADUser -DisplayName "Max Mustermann" -UserPrincipalName "[e-mail]" -Password "Passwort123!"

Anwendungsidentitäten

Bei der Verwaltung von Anwendungsidentitäten können Befehle wie New-AzADApplication, Get-AzADApplication, Set-AzADApplication und Remove-AzADApplication hilfreich sein.

# Beispiel: Neue Anwendung erstellen
New-AzADApplication -DisplayName "MeineApp" -IdentifierUris "http://meineapp" -HomePage "http://meineapp.com"

Gruppen verwalten

Benutzergruppen

Für die Verwaltung von Benutzergruppen stehen Befehle wie New-AzADGroup, Get-AzADGroup, Set-AzADGroup und Remove-AzADGroup zur Verfügung.

# Beispiel: Neue Benutzergruppe erstellen
New-AzADGroup -DisplayName "IT-Abteilung" -MailEnabled $true -MailNickName "IT" -SecurityEnabled $true

Anwendungsgruppen

Anwendungsgruppen können mithilfe von Befehlen wie New-AzADGroup, Get-AzADGroup, Set-AzADGroup und Remove-AzADGroup verwaltet werden.

# Beispiel: Neue Anwendungsgruppe erstellen
New-AzADGroup -DisplayName "MeineApp-Gruppe" -MailEnabled $false -SecurityEnabled $true

Weitere Informationen

Für weitere Informationen zu Azure AD-Identitäten und -Gruppen sowie zu den verfügbaren PowerShell-Befehlen können Sie die offizielle Azure PowerShell-Dokumentation konsultieren.

# Get all groups
Get-AzADGroup
# Get details of a group
Get-AzADGroup -ObjectId <id>
# Search group by string
Get-AzADGroup -SearchString "admin" | fl * #Search at the beginnig of DisplayName
Get-AzADGroup |?{$_.Displayname -match "admin"}
# Get members of group
Get-AzADGroupMember -GroupDisplayName <resource_group_name>
# Get roles of group
Get-AzRoleAssignment -ResourceGroupName <resource_group_name>

Benutzer zur Gruppe hinzufügen

Besitzer der Gruppe können neue Benutzer zur Gruppe hinzufügen

Add-AzureADGroupMember -ObjectId <group_id> -RefObjectId <user_id> -Verbose

Gruppen können dynamisch sein, was im Grunde bedeutet, dass ein Benutzer einer Gruppe hinzugefügt wird, wenn er bestimmte Bedingungen erfüllt. Natürlich könnte ein Benutzer, wenn die Bedingungen auf Attributen basieren, die er kontrollieren kann, diese Funktion missbrauchen, um in andere Gruppen zu gelangen. Überprüfen Sie, wie dynamische Gruppen auf der folgenden Seite missbraucht werden können:

Az - Dynamic Groups Privesc

Service Principals / Enterprise Applications

Beachten Sie, dass Service Principal in der PowerShell-Terminologie im Azure-Portal (Web) als Enterprise Applications bezeichnet wird.

# Get Service Principals
az ad sp list --all
az ad sp list --all --query "[].[displayName]" -o table
# Get details of one SP
az ad sp show --id 00000000-0000-0000-0000-000000000000
# Search SP by string
az ad sp list --all --query "[?contains(displayName,'app')].displayName"
# Get owner of service principal
az ad sp owner list --id <id> --query "[].[displayName]" -o table
# Get service principals owned by the current user
az ad sp list --show-mine
# List apps that have password credentials
az ad sp list --all --query "[?passwordCredentials != null].displayName"
# List apps that have key credentials (use of certificate authentication)
az ad sp list -all --query "[?keyCredentials != null].displayName"

Azure AD

Azure AD ist Microsofts Cloud-basierte Identitäts- und Zugriffsverwaltungsdienst, der es Organisationen ermöglicht, Benutzerkonten und Zugriffsrechte zu verwalten. Es bietet Funktionen wie das Single Sign-On (SSO), Multi-Faktor-Authentifizierung und die Integration mit anderen Microsoft-Diensten.

Sicherheitsüberprüfungen

Bei der Sicherheitsüberprüfung von Azure AD sollten Schwachstellen wie schwache Kennwörter, nicht verwendete Konten, übermäßige Berechtigungen und ungeschützte Anwendungen identifiziert werden. Durch die regelmäßige Überprüfung und Behebung dieser Schwachstellen können Sicherheitsrisiken minimiert werden.

Protokollierung und Überwachung

Die Protokollierung und Überwachung von Aktivitäten in Azure AD ist entscheidend, um verdächtige Aktivitäten zu erkennen und darauf zu reagieren. Durch die Überwachung von Anmeldeversuchen, Änderungen von Berechtigungen und anderen Aktivitäten können Sicherheitsvorfälle frühzeitig erkannt und eingedämmt werden.

Zugriffssteuerung

Die Implementierung strikter Zugriffskontrollen in Azure AD ist wichtig, um sicherzustellen, dass nur autorisierte Benutzer auf Ressourcen zugreifen können. Dies umfasst die Verwendung von Rollenbasierten Zugriffssteuerungen (RBAC), die Begrenzung von Administratorrechten und die regelmäßige Überprüfung und Aktualisierung von Zugriffsberechtigungen.

# Get Service Principals
Get-AzureADServicePrincipal -All $true
# Get details about a SP
Get-AzureADServicePrincipal -ObjectId <id> | fl *
# Get SP by string name or Id
Get-AzureADServicePrincipal -All $true | ?{$_.DisplayName -match "app"} | fl
Get-AzureADServicePrincipal -All $true | ?{$_.AppId -match "103947652-1234-5834-103846517389"}
# Get owner of SP
Get-AzureADServicePrincipal -ObjectId <id> | Get-AzureADServicePrincipalOwner |fl *
# Get objects owned by a SP
Get-AzureADServicePrincipal -ObjectId <id> | Get-AzureADServicePrincipalOwnedObject
# Get objects created by a SP
Get-AzureADServicePrincipal -ObjectId <id> | Get-AzureADServicePrincipalCreatedObject
# Get groups where the SP is a member
Get-AzureADServicePrincipal | Get-AzureADServicePrincipalMembership
Get-AzureADServicePrincipal -ObjectId <id> | Get-AzureADServicePrincipalMembership |fl *

Azure AD

Azure AD ist der Identitäts- und Zugriffsverwaltungsdienst von Microsoft für die Azure-Cloud. Es ist wichtig, die Sicherheit von Azure AD zu überprüfen, da es eine zentrale Rolle bei der Authentifizierung und Autorisierung von Benutzern in der Azure-Cloud spielt.

Überprüfen der Sicherheit von Azure AD

Um die Sicherheit von Azure AD zu überprüfen, können verschiedene Techniken angewendet werden, darunter:

• Überprüfung von Berechtigungen und Rollen in Azure AD

• Überprüfung von Konfigurationseinstellungen für Sicherheitsfeatures

• Überprüfung von Benutzerkonten und deren Berechtigungen

• Überprüfung von Anmeldungsaktivitäten und verdächtigen Mustern

Es ist wichtig, regelmäßige Sicherheitsüberprüfungen von Azure AD durchzuführen, um potenzielle Sicherheitslücken zu identifizieren und zu beheben.

# Get SPs
Get-AzADServicePrincipal
# Get info of 1 SP
Get-AzADServicePrincipal -ObjectId <id>
# Search SP by string
Get-AzADServicePrincipal | ?{$_.DisplayName -match "app"}
# Get roles of a SP
Get-AzRoleAssignment -ServicePrincipalName <String>

Dieses Skript verwendet die Azure AD Graph API, um Informationen zu Benutzern, Gruppen und Anwendungen abzurufen. Es kann nützlich sein, um eine Übersicht über die Konfiguration von Azure AD zu erhalten und potenzielle Sicherheitslücken zu identifizieren.

$Token = 'eyJ0eX..'
$URI = 'https://graph.microsoft.com/v1.0/applications'
$RequestParams = @{
Method  = 'GET'
Uri     = $URI
Headers = @{
'Authorization' = "Bearer $Token"
}
}
(Invoke-RestMethod @RequestParams).value

Der Besitzer eines Dienstprinzipals kann sein Passwort ändern.

Liste und versuche, für jede Unternehmens-App ein Clientgeheimnis hinzuzufügen

```powershell # Just call Add-AzADAppSecret Function Add-AzADAppSecret { <# .SYNOPSIS Add client secret to the applications.

.PARAMETER GraphToken Pass the Graph API Token

.EXAMPLE PS C:> Add-AzADAppSecret -GraphToken 'eyJ0eX..'

.LINK https://docs.microsoft.com/en-us/graph/api/application-list?view=graph-rest-1.0&tabs=http https://docs.microsoft.com/en-us/graph/api/application-addpassword?view=graph-rest-1.0&tabs=http #>

[CmdletBinding()] param( [Parameter(Mandatory=$True)] [String] $GraphToken = $null )

$AppList = $null $AppPassword = $null

List All the Applications

$Params = @{ "URI" = "https://graph.microsoft.com/v1.0/applications" "Method" = "GET" "Headers" = @{ "Content-Type" = "application/json" "Authorization" = "Bearer $GraphToken" } }

try { $AppList = Invoke-RestMethod @Params -UseBasicParsing } catch { }

Add Password in the Application

if($AppList -ne $null) { [System.Collections.ArrayList]$Details = @()

foreach($App in $AppList.value) { $ID = $App.ID $psobj = New-Object PSObject

$Params = @{ "URI" = "https://graph.microsoft.com/v1.0/applications/$ID/addPassword" "Method" = "POST" "Headers" = @{ "Content-Type" = "application/json" "Authorization" = "Bearer $GraphToken" } }

$Body = @{ "passwordCredential"= @{ "displayName" = "Password" } }

try { $AppPassword = Invoke-RestMethod @Params -UseBasicParsing -Body ($Body | ConvertTo-Json) Add-Member -InputObject $psobj -NotePropertyName "Object ID" -NotePropertyValue $ID Add-Member -InputObject $psobj -NotePropertyName "App ID" -NotePropertyValue $App.appId Add-Member -InputObject $psobj -NotePropertyName "App Name" -NotePropertyValue $App.displayName Add-Member -InputObject $psobj -NotePropertyName "Key ID" -NotePropertyValue $AppPassword.keyId Add-Member -InputObject $psobj -NotePropertyName "Secret" -NotePropertyValue $AppPassword.secretText $Details.Add($psobj) | Out-Null } catch { Write-Output "Failed to add new client secret to '$($App.displayName)' Application." } } if($Details -ne $null) { Write-Output "" Write-Output "Client secret added to : " Write-Output $Details | fl * } } else { Write-Output "Failed to Enumerate the Applications." } }

</details>

### Rollen

<div data-gb-custom-block data-tag="tabs"></div>

<div data-gb-custom-block data-tag="tab" data-title='az cli'>

```bash
# Get roles
az role definition list
# Get assigned roles
az role assignment list --all --query "[].roleDefinitionName"
az role assignment list --all | jq '.[] | .roleDefinitionName,.scope'
# Get info of 1 role
az role definition list --name "AzureML Registry User"
# Get only custom roles
az role definition list --custom-role-only
# Get only roles assigned to the resource group indicated
az role definition list --resource-group <resource_group>
# Get only roles assigned to the indicated scope
az role definition list --scope <scope>
# Get all the principals a role is assigned to
az role assignment list --all --query "[].{principalName:principalName,principalType:principalType,resourceGroup:resourceGroup,roleDefinitionName:roleDefinitionName}[?roleDefinitionName=='<ROLE_NAME>']"

Azure AD Enumeration

User Enumeration

User enumeration can be performed through the login interface by identifying different responses for valid and invalid users.

Tools

• Azure AD Internals: A tool that can be used to enumerate users and groups in Azure AD.

Group Enumeration

Group enumeration involves identifying Azure AD groups and their members.

Tools

• Azure AD Internals: Can also be used to enumerate groups in Azure AD.

Device Enumeration

Device enumeration can be performed to identify devices registered in Azure AD.

Tools

• Azure AD Internals: Can also bejson used to enumerate devices in Azure AD.

Application Enumeration

Application enumeration involves identifying applications registered in Azure AD.

Tools

• Azure AD Internals: Can be used to enumerate applications in Azure AD.

Service Principal Enumeration

Service principal enumeration can be performed to identify service principals in Azure AD.

Tools

• Azure AD Internals: Can be used to enumerate service principals in Azure AD.

Tenant Enumeration

Tenant enumeration involves identifying tenant information in Azure AD.

Tools

• Azure AD Internals: Can be used to enumerate tenant information in Azure AD.

Domain Enumeration

Domain enumeration can be performed to identify domains associated with Azure AD.

Tools

• Azure AD Internals: Canjson be used to enumerate domains in Azure AD.

Policy Enumeration

Policy enumeration involves identifying policies configured in Azure AD.

Tools

• Azure AD Internals: Can be used to enumerate policies in Azure AD.

Role Enumeration

Role enumeration can be performed to identify roles assigned in Azure AD.

Tools

• Azure AD Internals: Can be used to enumerate roles in Azure AD.

Certificate Enumeration

Certificate enumeration involves identifying certificates used in Azure AD.

Tools

• Azure AD Internals: Can be used to enumerate certificates in Azure AD.

OAuth App Enumeration

OAuth app enumeration can be performed to identify OAuth applications in Azure AD.

Tools

• Azure AD Internals: Can be used to enumerate OAuth applications in Azure AD.

App Registration Enumeration

App registration enumeration involves identifying registered applications in Azure AD.

Tools

• Azure AD Internals: Can be used to enumerate registered applications in Azurejson AD.

App Role Enumeration

App role enumeration can be performed to identify app roles in Azure AD.

Tools

• Azure AD Internals: Can be used to enumerate app roles in Azure AD.

App Secret Enumeration

App secret enumeration involves identifying secrets associated with registered applications in Azure AD.

Tools

• Azure AD Internals: Can be used to enumerate app secrets in Azure AD.

App Permission Enumeration

App permission enumeration can be performed to identify permissions assigned to applications in Azure AD.

Tools

• Azure AD Internals: Can be used to enumerate app permissions in Azure AD.

App Credential Enumeration

App credential enumeration involves identifying credentials associated with registered applications in Azure AD.

Tools

• Azure AD Internals: Can be used to enumerate app credentials in Azure AD.

App Scope Enumeration

App scope enumeration can be performed to identify scopes assigned to applications in Azure AD.

Tools

• Azure AD Internals: Can be used to enumerate app scopes in Azure AD.

App Redirect URI Enumeration

App redirect URI enumeration involves identifying redirect URIs configured for applications in Azure AD.

Tools

• Azure AD Internals: Can be used to enumerate app redirect URIs in Azure AD.

App API Enumeration

App API enumeration can be performed to identify APIs associated with applications in Azure AD.

Tools

• Azure AD Internals: Can be used to enumerate app APIs in Azure AD.

App Consent Enumeration

App consent enumeration involves identifying consents granted to applications in Azure AD.

Tools

• Azure AD Internals: Can be used to enumerate app consents in Azure AD.

App Federation Enumeration

App federation enumeration can be performed to identify federated applications in Azure AD.

Tools

• Azure AD Internals: Can be used to enumerate federated applications in Azure AD.

App SAML Enumeration

App SAML enumeration involves identifying SAML configurations for applications in Azure AD.

Tools

• Azure AD Internals: Can be used to enumerate SAML configurations in Azure AD.

App OpenID Connect Enumeration

App OpenID Connect enumeration can be performed to identify OpenID Connect configurations for applications in Azure AD.

Tools

• Azure AD Internals: Can be used to enumerate OpenID Connect configurations in Azure AD.

App Home Realm Enumeration

App Home Realm enumeration involves identifying home realms configured for applications in Azure AD.

Tools

• Azure AD Internals: Can be used to enumerate home realms in Azure AD.

App Sign-On URL Enumeration

App Sign-On URL enumeration can be performed to identify sign-on URLs configured for applications in Azure AD.

Tools

• Azure AD Internals: Can be used to enumerate sign-on URLs in Azure AD.

App Reply URL Enumeration

App Reply URL enumeration involves identifying reply URLs configured for applications injson Azure AD.

Tools

• Azure AD Internals: Can be used to enumerate reply URLs in Azure AD.

App Branding Enumeration

App branding enumeration can be performed to identify branding configurations for applications in Azure AD.

Tools

• Azure AD Internals: Can be used to enumerate branding configurations in Azure AD.

App Extension Enumeration

App extension enumeration involves identifying extensions configured for applications in Azure AD.

Tools

• Azure AD Internals: Can be used to enumerate extensions in Azure AD.

App Delegation Enumeration

App delegation enumeration can be performed to identify delegations configured for applications in Azure AD.

Tools

• Azure AD Internals: Can be used to enumerate delegations in Azure AD.

App User Enumeration

App user enumeration involves identifying users associated with applications in Azure AD.

Tools

• Azure AD Internals: Can be used to enumerate app users in Azure AD.

App Group Enumeration

App group enumeration can be performed to identify groups associated with applications in Azure AD.

Tools

• Azure AD Internals: Can be used to enumerate app groups in Azure AD.

App Permission Grant Enumeration

App permission grant enumeration involves identifying permission grants for applications in Azure AD.

Tools

• Azure AD Internals: Can be used to enumerate app permission grants in Azure AD.

App Role Assignment Enumeration

App role assignment enumeration can be performed to identify role assignments for applications in Azure AD.

Tools

• Azure AD Internals: Can be used to enumerate app role assignments in Azure AD.

App Credential Assignment Enumeration

App credential assignment enumeration involves identifying credential assignments for applications in Azure AD.

Tools

• Azure AD Internals: Can be used to enumerate app credential assignments in Azure AD.

App API Assignment Enumeration

App API assignment enumeration can be performed to identify API assignments for applications in Azure AD.

Tools

• Azure AD Internals: Can be used to enumerate app API assignments in Azure AD.

App Extension Assignment Enumeration

App extension assignment enumeration involves identifying extension assignments for applications in Azure AD.

Tools

• Azure AD Internals: Can be used to enumerate app extension assignments in Azure AD.

App Delegation Assignment Enumeration

App delegation assignment enumeration can be performed to identify delegation assignments for applications in Azure AD.

Tools

• Azure AD Internals: Can be used to enumerate app delegation assignments in Azure AD.

App User Assignment Enumeration

App user assignment enumeration involves identifying user assignments for applications in Azure AD.

Tools

• Azure AD Internals: Can be used to enumerate app user assignments in Azure AD.

App Group Assignment Enumeration

App group assignment enumeration can be performed to identify group assignments for applications in Azure AD.

Tools

• Azure AD Internals: Can be used to enumerate app group assignments in Azure AD.

App Registration Assignment Enumeration

App registration assignment enumeration involves identifying registration assignments for applications in Azure AD.

Tools

• Azure AD Internals: Can be used to enumerate app registration assignments in Azure AD.

App Role Assignment Enumeration

App role assignment enumeration can bejson performed to identify role assignments for applications in Azure AD.

Tools

• Azure AD Internals: Can be used to enumerate app role assignments in Azure AD.

App Credential Assignment Enumeration

App credential assignment enumeration involves identifying credential assignments for applications in Azure AD.

Tools

• Azure AD Internals: Can be used to enumerate app credential assignments in Azure AD.

App API Assignment Enumeration

App API assignment enumeration can be performed to identify API assignments for applications in Azure AD.

Tools

• Azure AD Internals: Can be used to enumerate app API assignments in Azure AD.

App Extension Assignment Enumeration

App extension assignment enumeration involves identifying extension assignments for applications in Azure AD.

Tools

• Azure AD Internals: Can be used to enumerate app extension assignments in Azure AD.

App Delegation Assignment Enumeration

App delegation assignment enumeration can be performed to identify delegation assignments for applications in Azure AD.

Tools

• Azure AD Internals: Can be used to enumerate app delegation assignments in Azure AD.

App User Assignment Enumeration

App user assignment enumeration involves identifying user assignments for applications in Azure AD.

Tools

• Azure AD Internals: Can be used to enumerate app user assignments in Azure AD.

App Group Assignment Enumeration

App group assignment enumeration can be performed to identify group assignments for applications in Azure AD.

Tools

• Azure AD Internals: Can be used to enumerate app group assignments in Azure AD.

App Registration Assignment Enumeration

App registration assignment enumeration involves identifying registration assignments for applications in Azure AD.

Tools

• Azure AD Internals: Can be used to enumerate app registration assignments in Azure AD.

App Role Assignment Enumeration

App role assignment enumeration can bejson performed to identify role assignments for applications in Azure AD.

Tools

• Azure AD Internals: Can be used to enumerate app role assignments in Azure AD.

App Credential Assignment Enumeration

App credential assignment enumeration involves identifying credential assignments for applications in Azure AD.

Tools

• Azure AD Internals: Can be used to enumerate app credential assignments in Azure AD.

App API Assignment Enumeration

App API assignment enumeration can be performed to identify API assignments for applications in Azure AD.

Tools

• Azure AD Internals: Can be used to enumerate app API assignments in Azure AD.

App Extension Assignment Enumeration

App extension assignment enumeration involves identifying extension assignments for applications in Azure AD.

Tools

• Azure AD Internals: Can be used to enumerate app extension assignments in Azure AD.

App Delegation Assignment Enumeration

App delegation assignment enumeration can be performed to identify delegation assignments for applications in Azure AD.

Tools

• Azure AD Internals: Can be used to enumerate app delegation assignments in Azure AD.

App User Assignment Enumeration

App user assignment enumeration involves identifying user assignments for applications in Azure AD.

Tools

• Azure AD Internals: Can be used to enumerate app user assignments in Azure AD.

App Group Assignment Enumeration

App group assignment enumeration can be performed to identify group assignments for applications in Azure AD.

Tools

• Azure AD Internals: Can be used to enumerate app group assignments in Azure AD.

App Registration Assignment Enumeration

App registration assignment enumeration involves identifying registration assignments for applications in Azure AD.

Tools

• Azure AD Internals: Can be used to enumerate app registration assignments in Azure AD.

# Get all available role templates
Get-AzureADDirectoryroleTemplate
# Get enabled roles (Assigned roles)
Get-AzureADDirectoryRole
Get-AzureADDirectoryRole -ObjectId <roleID> #Get info about the role
# Get custom roles - use AzureAdPreview
Get-AzureADMSRoleDefinition | ?{$_.IsBuiltin -eq $False} | select DisplayName
# Users assigned a role (Global Administrator)
Get-AzureADDirectoryRole -Filter "DisplayName eq 'Global Administrator'" | Get-AzureADDirectoryRoleMember
Get-AzureADDirectoryRole -ObjectId <id> | fl
# Roles of the Administrative Unit (who has permissions over the administrative unit and its members)
Get-AzureADMSScopedRoleMembership -Id <id> | fl *

Azure AD

Azure AD ist der Identitäts- und Zugriffsverwaltungsdienst von Microsoft für die Azure-Cloud. Es ist wichtig, die Sicherheit von Azure AD zu überprüfen, da es eine zentrale Rolle bei der Authentifizierung und Autorisierung von Benutzern in der Azure-Cloud spielt.

Überprüfen der Sicherheit von Azure AD

Um die Sicherheit von Azure AD zu überprüfen, können verschiedene Techniken angewendet werden, darunter:

• Überprüfung von Berechtigungen und Rollen in Azure AD

• Überprüfung von Konfigurationseinstellungen für Sicherheitsfunktionen

• Überprüfung von Benutzerkonten und deren Berechtigungen

• Überprüfung von Anmeldungsaktivitäten und verdächtigen Mustern

Es ist wichtig, regelmäßige Sicherheitsüberprüfungen von Azure AD durchzuführen, um potenzielle Sicherheitslücken zu identifizieren und zu beheben. Dies trägt dazu bei, die Gesamtsicherheit der Azure-Cloud-Umgebung zu gewährleisten.

# Get role assignments on the subscription
Get-AzRoleDefinition
# Get Role definition
Get-AzRoleDefinition -Name "Virtual Machine Command Executor"
# Get roles of a user or resource
Get-AzRoleAssignment -SignInName [e-mail]
Get-AzRoleAssignment -Scope /subscriptions/<subscription-id>/resourceGroups/<res_group_name>/providers/Microsoft.Compute/virtualMachines/<vm_name>

# Get permissions over a resource using ARM directly
$Token = (Get-AzAccessToken).Token
$URI = 'https://management.azure.com/subscriptions/b413826f-108d-4049-8c11-d52d5d388768/resourceGroups/Research/providers/Microsoft.Compute/virtualMachines/infradminsrv/providers/Microsoft.Authorization/permissions?api-version=2015-07-01'
$RequestParams = @{
Method = 'GET'
Uri = $URI
Headers = @{
'Authorization' = "Bearer $Token"
}
}
(Invoke-RestMethod @RequestParams).value

Geräte

# If you know how to do this send a PR!

Azure AD Enumeration

Azure AD enumeration is the process of gathering information about Azure AD users, groups, applications, and permissions. This information can be used by attackers to identify potential targets and plan further attacks.

Tools for Azure AD Enumeration

There are several tools available for enumerating Azure AD, such as:

• Azure AD Recon: A tool for gathering information about Azure AD users, groups, and applications.

• Azure AD Exploitation Framework (AADExPloitation): A framework for enumerating Azure AD users, groups, and applications, as well as exploiting misconfigurations.

Techniques for Azure AD Enumeration

Some common techniques for Azure AD enumeration include:

• User Enumeration: Enumerating Azure AD users to gather information such as usernames, email addresses, and group memberships.

• Group Enumeration: Enumerating Azure AD groups to identify group names, descriptions, and members.

• Application Enumeration: Enumerating Azure AD applications to discover application names, permissions, and configurations.

• Permission Enumeration: Enumerating Azure AD permissions to identify users with elevated privileges and misconfigured permissions.

By using these tools and techniques, attackers can gather valuable information about an organization's Azure AD environment and potentially exploit misconfigurations or vulnerabilities.

# Enumerate Devices
Get-AzureADDevice -All $true | fl *
# List all the active devices (and not the stale devices)
Get-AzureADDevice -All $true | ?{$_.ApproximateLastLogonTimeStamp -ne $null}
# Get owners of all devices
Get-AzureADDevice -All $true | Get-AzureADDeviceRegisteredOwner
Get-AzureADDevice -All $true | %{if($user=Get-AzureADDeviceRegisteredOwner -ObjectId $_.ObjectID){$_;$user.UserPrincipalName;"`n"}}
# Registred users of all the devices
Get-AzureADDevice -All $true | Get-AzureADDeviceRegisteredUser
Get-AzureADDevice -All $true | %{if($user=Get-AzureADDeviceRegisteredUser -ObjectId $_.ObjectID){$_;$user.UserPrincipalName;"`n"}}
# Get dives managed using Intune
Get-AzureADDevice -All $true | ?{$_.IsCompliant -eq "True"}
# Get devices owned by a user
Get-AzureADUserOwnedDevice -ObjectId [e-mail]
# Get Administrative Units of a device
Get-AzureADMSAdministrativeUnit | where { Get-AzureADMSAdministrativeUnitMember -ObjectId $_.ObjectId | where {$_.ObjectId -eq $deviceObjId} }

Wenn ein Gerät (VM) AzureAD-verbunden ist, können Benutzer aus AzureAD sich anmelden. Darüber hinaus, wenn der angemeldete Benutzer Besitzer des Geräts ist, wird er lokaler Administrator sein.

Anwendungen

Apps sind App-Registrierungen im Portal (nicht Unternehmensanwendungen). Aber jede App-Registrierung wird eine Unternehmensanwendung (Serviceprinzipal) mit demselben Namen erstellen. Darüber hinaus, wenn die App eine Multi-Tenant-App ist, wird eine weitere Unternehmensanwendung (Serviceprinzipal) in diesem Mandanten mit demselben Namen erstellt.

Wenn eine App generiert wird, werden 2 Arten von Berechtigungen erteilt:

• Berechtigungen, die dem Serviceprinzipal erteilt werden

• Berechtigungen, die die App haben und im Namen des Benutzers verwenden kann.

# List Apps
az ad app list
az ad app list --query "[].[displayName]" -o table
# Get info of 1 App
az ad app show --id 00000000-0000-0000-0000-000000000000
# Search App by string
az ad app list --query "[?contains(displayName,'app')].displayName"
# Get the owner of an application
az ad app owner list --id <id> --query "[].[displayName]" -o table
# List all the apps with an application password
az ad app list --query "[?passwordCredentials != null].displayName"
# List apps that have key credentials (use of certificate authentication)
az ad app list --query "[?keyCredentials != null].displayName"

Azure AD

Azure AD Connect synchronizes users' identities between Azure AD and on-premises Active Directory. This allows for a seamless sign-on experience to various applications and resources.

Enumeration

1. User Enumeration: Enumerate users through the Graph API, looking for common usernames or service accounts.

2. Group Enumeration: Enumerate groups to understand the organization's structure and potential points of privilege escalation.

3. Application Enumeration: Discover applications registered in Azure AD to identify potential targets for further attacks.

Password Attacks

1. Password Spraying: Attempt a few common passwords across many accounts to avoid account lockouts.

2. Brute Force: Perform a brute force attack to crack weak passwords or gain unauthorized access.

Token Manipulation

1. Token Impersonation: Steal or forge tokens to impersonate users and access resources illegitimately.

2. Token Replay: Capture and replay tokens to gain unauthorized access to resources.

Federation Attacks

1. Federation Trust: Exploit misconfigurations in federation trust to gain unauthorized access.

2. Federation Impersonation: Impersonate a federated domain to access resources in Azure AD.

Privilege Escalation

1. Role Escalation: Elevate privileges by assigning higher roles to compromised accounts.

2. Application Role Mapping: Abuse misconfigured application roles to gain excessive permissions.

Persistence

1. Backdoors: Create backdoors in Azure AD configurations for persistent access.

2. Service Principal: Abuse service principals for long-term access to resources.

Data Exfiltration

1. User Data: Extract sensitive user data from Azure AD for malicious purposes.

2. Application Data: Steal or manipulate application data stored in Azure AD.

Remediation

1. Multi-Factor Authentication: Enforce MFA to protect against password attacks and unauthorized access.

2. Regular Auditing: Conduct regular audits to detect and mitigate security issues in Azure AD configurations.

# List all registered applications
Get-AzureADApplication -All $true
# Get details of an application
Get-AzureADApplication -ObjectId <id>  | fl *
# List all the apps with an application password
Get-AzureADApplication -All $true | %{if(Get-AzureADApplicationPasswordCredential -ObjectID $_.ObjectID){$_}}
# Get owner of an application
Get-AzureADApplication -ObjectId <id> | Get-AzureADApplicationOwner |fl *

Azure AD

Enumerate Azure AD roles

1. Description: Enumerate Azure AD roles assigned to users or groups.

2. Attack: An attacker can use this information to understand the level of access different users or groups have within Azure AD.

3. Defense: Regularly review and audit Azure AD roles assigned to users and groups to ensure least privilege access.

4. Tool: Azure PowerShell

5. Code:

   Get-AzureADUserMembership -ObjectId <UserObjectId>

6. Impact: Information disclosure of Azure AD roles assigned to users or groups.

7. Recommendation: Implement the principle of least privilege when assigning Azure AD roles to users and groups.

# Get Apps
Get-AzADApplication
# Get details of one App
Get-AzADApplication -ObjectId <id>
# Get App searching by string
Get-AzADApplication | ?{$_.DisplayName -match "app"}
# Get Apps with password
Get-AzADAppCredential

Eine App mit der Berechtigung AppRoleAssignment.ReadWrite kann sich zu einem Globalen Administrator eskalieren, indem sie sich selbst die Rolle gewährt. Für weitere Informationen überprüfen Sie dies.

Ein geheimer String, den die Anwendung verwendet, um ihre Identität bei der Beantragung eines Tokens zu beweisen, ist das Anwendungspasswort. Wenn Sie dieses Passwort finden, können Sie als Serviceprinzipal innerhalb des Mandanten zugreifen. Beachten Sie, dass dieses Passwort nur sichtbar ist, wenn es generiert wird (Sie könnten es ändern, aber Sie können es nicht erneut abrufen). Der Besitzer der Anwendung kann ein Passwort hinzufügen (um sich als diese auszugeben). Anmeldungen als diese Serviceprinzipale sind nicht als riskant markiert und sie haben keine MFA.

Unterschied zwischen Anwendungen & (Unternehmensanwendungen oder Serviceprinzipale)

Unterschied zwischen einer Anwendung und einem Serviceprinzipal in Azure:

• Anwendung/App-Registrierungen: Sind Anwendungen, die in Ihrem Azure AD existieren

• (Get-AzureADApplication -filter "DisplayName eq 'testapp'")

• Serviceprinzipal/Unternehmensanwendungen: Sicherheitsobjekte in Ihrem Azure AD, die Privilegien im Azure-Verzeichnis haben können und mit Ihrer Anwendung oder einer Anwendung eines Drittanbieters verknüpft sind

• Get-AzureADServicePrincipal -filter "DisplayName eq 'testapp'")

• Ein Administrator muss die gewährten Berechtigungen möglicherweise genehmigen, wenn sie sehr sensibel sind.

Eine Anwendung kann in einem Drittanbietermandanten ausgeführt werden, und sobald Sie sie verwenden und ihr Zugriff gewähren, wird ein Unternehmensanwendung/Serviceprinzipal in Ihrem Mandanten erstellt, um ihr den Zugriff auf die benötigten Informationen zu ermöglichen:

Administratoreinheiten

Sie werden zur besseren Verwaltung von Benutzern verwendet.

Administratoreinheiten beschränken Berechtigungen in einer Rolle auf einen beliebigen Teil Ihrer Organisation, den Sie definieren. Sie könnten beispielsweise administrative Einheiten verwenden, um die Helpdesk-Administrator-Rolle an regionale Support-Spezialisten zu delegieren, damit sie nur Benutzer in der von ihnen unterstützten Region verwalten können.

Daher können Sie Rollen der Administrator-Einheit zuweisen, und die Mitglieder davon werden diese Rollen haben.

Azure AD

Azure AD ist Microsofts Cloud-basierte Identitäts- und Zugriffsverwaltungsdienst, der es Organisationen ermöglicht, Benutzerkonten und Zugriffsrechte zu verwalten. Es bietet Funktionen wie das Single Sign-On (SSO), Multi-Faktor-Authentifizierung und die Integration mit anderen Microsoft-Diensten.

Sicherheitsüberprüfungen

Bei der Sicherheitsüberprüfung von Azure AD sollten Schwachstellen wie schwache Kennwörter, nicht verwendete Konten, übermäßige Berechtigungen und ungeschützte Anwendungen identifiziert werden. Es ist wichtig, die Sicherheitseinstellungen regelmäßig zu überprüfen und sicherzustellen, dass bewährte Sicherheitspraktiken befolgt werden.

Angriffstechniken

Angreifer könnten versuchen, über Phishing-Angriffe, Brute-Force-Angriffe oder Schwachstellen in Anwendungen Zugriff auf Azure AD zu erlangen. Durch regelmäßige Sicherheitsüberprüfungen und Schulungen der Benutzer können Organisationen das Risiko von Angriffen verringern.

Empfehlungen

Um die Sicherheit von Azure AD zu verbessern, sollten Organisationen Multi-Faktor-Authentifizierung aktivieren, starke Kennwortrichtlinien implementieren, nicht verwendete Konten deaktivieren und regelmäßige Sicherheitsschulungen für Benutzer durchführen.

# Get Administrative Units
Get-AzureADMSAdministrativeUnit
Get-AzureADMSAdministrativeUnit -Id <id>
# Get ID of admin unit by string
$adminUnitObj = Get-AzureADMSAdministrativeUnit -Filter "displayname eq 'Test administrative unit 2'"
# List the users, groups, and devices affected by the administrative unit
Get-AzureADMSAdministrativeUnitMember -Id <id>
# Get the roles users have over the members of the AU
Get-AzureADMSScopedRoleMembership -Id <id> | fl #Get role ID and role members

Azure AD Identity Protection (AIP)

Azure AD Identity Protection (AIP) ist ein Sicherheitsdienst, der automatisierte Erkennung und Behebung verwendet, um Benutzeridentitäten im Azure Active Directory vor Kompromittierung zu schützen. AIP überwacht kontinuierlich und bewertet das Risiko von Benutzeranmeldungen und Identitätskonfigurationen, wenden automatisch geeignete Sicherheitsmaßnahmen an, wie z. B. die Anforderung von Multi-Faktor-Authentifizierung oder das Blockieren potenziell gefährlicher Aktivitäten. Dies hilft Organisationen, Sicherheitsverletzungen aufgrund von Identitäten zu verhindern.

Ablauf:

1. Azure AD Identity Protection überwacht Benutzeraktivitäten und sammelt Daten zu Benutzer Anmeldungen, Authentifizierungs-Ereignissen und anderen relevanten Aktivitäten.

2. Der Dienst verwendet Machine-Learning-Algorithmen, um diese Daten zu analysieren und potenzielle Sicherheitsbedrohungen zu erkennen.

3. Azure AD Identity Protection weist der Bedrohung ein Risikolevel zu (z. B. Anmeldung) und generiert bei Bedarf einen Alarm, um eine automatische Aktion durchzuführen.

Azure AD Password Protection (APP)

Azure AD Password Protection (APP) ist eine Sicherheitsfunktion, die hilft, schwache Passwörter im Azure Active Directory durch die Durchsetzung starker Passwortrichtlinien zu verhindern. APP blockiert häufig verwendete schwache Passwörter und deren Varianten, was das Risiko von passwortbezogenen Verstößen verringert. Es kann sowohl auf Cloud-Ebene als auch im lokalen Active Directory angewendet werden und verbessert die allgemeine Passwortsicherheit in der gesamten Organisation.

Referenzen

• https://learn.microsoft.com/en-us/azure/active-directory/roles/administrative-units

Lernen Sie & üben Sie AWS-Hacking:HackTricks Training AWS Red Team Expert (ARTE) Lernen Sie & üben Sie GCP-Hacking: HackTricks Training GCP Red Team Expert (GRTE)