Identity security protection methods, systems, and storage media based on Azure AD control capabilities

Abstract

The application belongs to the technical field of computer network security, and particularly relates to a Kerberos protocol weak encryption and cloud dynamic strategy combined privilege escalation method. The method comprises the following steps: using SYSTEM level permission to access a target user object in AD, modifying a preset condition conforming to a cloud privilege dynamic group membership rule to obtain a tampered target user attribute; using an Azure AD Connect synchronization service to mark the tampered target user attribute as an attribute update event, and determining that abnormal data flow conforms to normal business synchronization characteristics; constructing a ticket by using a Kerberos client library according to an NTLM hash of a target user account to obtain a fake ticket; the target user account is dynamically added to an associated global administrator role group to obtain a target user account with a global administrator session token; and the target user account is logged in to a PTA service channel by using the fake ticket to obtain Azure AD control capability.

Description

Technical Field

[0001] This application belongs to the field of computer network security technology, and in particular relates to an identity security protection method, system and storage medium based on Azure AD control capabilities. Background Technology

[0002] With the widespread adoption of cloud computing and hybrid architectures, government, military, and financial institutions are gradually migrating their core business systems to public cloud platforms and relying on hybrid identity models to achieve seamless identity authentication and access control. While this initiative has improved efficiency for these institutions, it has also exposed new challenges: there are design blind spots between target devices and the cloud, allowing malicious users to exploit identity synchronization mechanisms to convert low-privilege access on target devices into privileged access on the cloud.

[0003] In view of this, there is an urgent need for an identity security protection method based on Azure AD control capabilities. Summary of the Invention

[0004] Therefore, it is necessary to provide an identity security protection method based on Azure AD control capabilities to address the aforementioned technical issues.

[0005] Firstly, this application provides an identity security protection method based on Azure AD control capabilities, including:

[0006] The system acquires the target device and modifies its permissions via malicious process injection or registry key tampering to obtain SYSTEM-level privileges.

[0007] Using the SYSTEM level privileges, the standard department attribute field of the target user object in AD, as well as the extended attribute field with permission mapping function in the hybrid cloud synchronization scenario, are accessed to modify the target user attributes in accordance with the preset conditions of the cloud privileged dynamic group membership rules.

[0008] Using Azure AD Connect synchronization service, the modified target user attributes are uploaded to Azure AD via API channel in a compliant protocol format and marked as attribute update events to determine that the abnormal data stream conforms to the characteristics of normal business synchronization.

[0009] Based on the NTLM hash of the target user account of the target device, a Kerberos ticket is constructed using the Kerberos client library to obtain a forged ticket;

[0010] Once Azure AD completes attribute synchronization, the cloud-based dynamic group membership engine evaluates and modifies the target user's attributes. The target user account is then dynamically added to the associated global administrator role group, resulting in a target user account with a global administrator session token.

[0011] Under the target user account with a global administrator session token, the forged ticket is used to log in to the PTA service channel and gain control over Azure AD.

[0012] By leveraging Azure AD's control capabilities, cloud service providers and security vendors can develop verifiable attack behavior reproduction solutions, thereby building an identity security protection mechanism.

[0013] In some feasible methods, obtaining the target device and modifying its permissions through malicious process injection or registry key tampering to acquire SYSTEM-level privileges includes the following steps:

[0014] By exploiting an unpatched target device privilege escalation vulnerability in Windows systems, initial execution privileges were obtained on the target device.

[0015] Based on the initial execution permissions of the target device, SYSTEM level permissions are obtained by injecting a high-privilege process or modifying registry key values.

[0016] In some feasible methods, the step of using the SYSTEM level privileges to access the standard department attribute field of the target user object in AD, and the extended attribute field with permission mapping function in the hybrid cloud synchronization scenario, to modify the target user attributes in accordance with the preset conditions of the cloud privileged dynamic group membership rules, includes:

[0017] Analyze the rules of the msDS-CloudExtension Attribute metadata in the AD architecture to obtain matching rules;

[0018] According to the matching rules, using the SYSTEM level permissions, the standard department attribute field of the target user object in AD, as well as the extended attribute field with permission mapping function in the hybrid cloud synchronization scenario, are modified according to the preset conditions of the cloud privileged dynamic group membership rules, so as to obtain the tampered target user attributes.

[0019] Among the feasible methods, the steps of utilizing Azure AD Connect synchronization service to upload the tampered target user attributes to Azure AD via API channel in a compliant protocol format and mark it as an attribute update event, and determining that the abnormal data stream conforms to the characteristics of normal business synchronization, include:

[0020] Using the aforementioned SYSTEM level privileges, the Azure AD Connect synchronization service can be hijacked, or the Start-ADSyncSync Cycle PowerShell command can be invoked to force the start of an incremental synchronization cycle and obtain synchronization instructions.

[0021] According to the synchronization instructions, the tampered target user attributes will be uploaded to Azure AD via the Microsoft Graph API channel in a compliant DirSync protocol format and marked as a cloudAnchor attribute update event, confirming that the abnormal data stream conforms to the characteristics of normal business synchronization.

[0022] In some feasible methods, the step of constructing a Kerberos ticket using a Kerberos client library based on the NTLM hash of the target user account of the target device to obtain a forged ticket includes:

[0023] Based on the NTLM hash of the target user account of the target device, the core functions of the Kerberos client library are used to construct a Kerberos ticket according to the Kerberos protocol specification, resulting in a Kerberos Silver Ticket forged ticket with a service subject name binding. The Kerberos Silver Ticket forged ticket includes key field tampering: the user subject name is set to a high-privilege administrator account, the ticket validity period is extended to the maximum allowed threshold, and the service category is specified as the hybrid authentication core service.

[0024] In some feasible implementations, the step of having the target user account dynamically added to the associated global administrator role group by the cloud dynamic group membership engine to obtain a target user account with a global administrator session token after Azure AD completes attribute synchronization includes:

[0025] Once Azure AD completes attribute synchronization, the cloud-based dynamic group membership engine is used to assess the tampering with the target user's attributes, and the target user account is dynamically added to the associated global administrator role group.

[0026] Based on the global administrator role group, the Azure AD identity provider issues a session token to obtain the target user account with the global administrator session token.

[0027] In some feasible approaches, the step of logging into the PTA service channel using the forged ticket under a target user account with a global administrator session token to obtain Azure AD control capabilities includes:

[0028] Using a forged Kerberos Silver Ticket, a login request was initiated through the PTA service channel, and a global administrator session token was mistakenly granted by Azure AD;

[0029] By using a global administrator session token to call the Microsoft Graph API, high-risk privileged operations can be performed to gain control over Azure AD.

[0030] Secondly, this application provides an identity security protection system based on Azure AD control capabilities, applied to the aforementioned identity security protection method based on Azure AD control capabilities. The system includes:

[0031] The local privilege escalation and attribute tampering module is used to obtain the target device and tamper with the permissions of the target device through malicious process injection or registry key values ​​to obtain SYSTEM level privileges.

[0032] The local privilege escalation and attribute tampering module is also used to utilize the SYSTEM level privileges to access the standard department attribute field of the target user object in AD, as well as the extended attribute field with permission mapping function in the hybrid cloud synchronization scenario, to modify the target user attributes in accordance with the preset conditions of the cloud privileged dynamic group membership rules.

[0033] The local privilege escalation and attribute tampering module is also used to utilize the Azure AD Connect synchronization service to upload the tampered target user attributes to Azure AD via the API channel in a compliant protocol format, and mark it as an attribute update event, to determine that the abnormal data stream conforms to the characteristics of normal business synchronization.

[0034] The Kerberos ticket forgery module is used to construct a Kerberos ticket using the Kerberos client library based on the NTLM hash of the target user account of the target device, and obtain a forged ticket.

[0035] The Attribute Synchronization and Dynamic Group Triggering Module is used to evaluate and modify the target user's attributes after Azure AD completes attribute synchronization. The target user account is then dynamically added to the associated global administrator role group, resulting in a target user account with a global administrator session token.

[0036] The PTA authentication and cloud control module is used to log in to the PTA service channel using the forged ticket under the target user account with a global administrator session token, and obtain Azure AD control capabilities.

[0037] By leveraging Azure AD's control capabilities, cloud service providers and security vendors can develop verifiable attack behavior reproduction solutions, thereby building an identity security protection mechanism.

[0038] Thirdly, this application provides a computer storage medium storing a computer program thereon, which, when executed by a processor, implements the steps of the aforementioned identity security protection method based on Azure AD control capabilities.

[0039] Fourthly, this application provides a computer program that, when executed by a processor, implements the steps of the aforementioned identity security protection method based on Azure AD control capabilities.

[0040] Beneficial Effects: This application provides an identity security protection method based on Azure AD control capabilities, including obtaining the target device and modifying its permissions through malicious process injection or registry key values ​​to obtain SYSTEM-level permissions; using SYSTEM-level permissions, accessing the standard department attribute field of the target user object in AD, as well as the extended attribute field with permission mapping function in hybrid cloud synchronization scenarios, and modifying it according to preset conditions that comply with the cloud privileged dynamic group membership rules to obtain tampered target user attributes; using the Azure AD Connect synchronization service, uploading the tampered target user attributes to Azure AD through the API channel in a compliant protocol format and marking it as an attribute update event to determine that the abnormal data stream conforms to the characteristics of normal business synchronization; constructing a Kerberos ticket using the Kerberos client library based on the NTLM hash of the target user account on the target device to obtain a forged ticket; after Azure AD completes attribute synchronization, the cloud dynamic group membership engine evaluates the tampered target user attributes, and the target user account is dynamically added to the associated global administrator role group to obtain a target user account with a global administrator session token; under the target user account with the global administrator session token, logging into the PTA service channel using the forged ticket to obtain Azure AD control capabilities. The above methods deeply embed the attack into the automated workflow of the hybrid cloud architecture: AD Connect's synchronization mechanism triggers permission policies, PTA authentication bypasses two-factor authentication through trust transfer, and role-based access control using dynamic groups automates the elimination of manual approval steps. The entire attack relies solely on standard functional components commonly found in the target environment, without exploiting any undisclosed vulnerabilities or non-standard configuration flaws. Attached Figure Description

[0041] To more clearly illustrate the technical solutions in the embodiments of this application or the conventional technology, the drawings used in the description of the embodiments or the conventional technology will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0042] Figure 1 This is a flowchart of an identity security protection method based on Azure AD control capabilities in one embodiment;

[0043] Figure 2 This is a logic diagram of an identity security protection method based on Azure AD control capabilities in one embodiment;

[0044] Figure 3 This is a schematic diagram of a malicious user privilege escalation scheme for an identity security protection method based on Azure AD control capabilities in one embodiment. Detailed Implementation

[0045] To facilitate understanding of this application, a more complete description will be provided below with reference to the accompanying drawings, which illustrate embodiments of the present application. However, the present application can be implemented in many different forms and is not limited to the embodiments described herein. Rather, these embodiments are provided so that the disclosure of this application will be thorough and complete.

[0046] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. The term "and / or" as used herein includes any and all couplings of one or more of the associated listed items.

[0047] It is understood that the terms “first,” “second,” etc., used in this application may be used herein to describe various elements, but these elements are not limited by these terms. These terms are only used to distinguish one element from another.

[0048] The following explanations of some terms used in this application are provided to aid in understanding the application:

[0049] AD, a directory service developed by Microsoft, is used to centrally manage network resources such as users, computers, and printers in a local area network (LAN).

[0050] Azure AD, Microsoft's cloud-native identity and access management service, is designed for modern hybrid cloud environments.

[0051] MFA, a technology that enhances authentication security, requires users to provide at least two different types of credentials or factors when logging in, including: knowledge factors (such as passwords), possession factors (such as mobile verification codes or hardware keys), and biometrics (such as fingerprints or facial recognition).

[0052] PTA, a hybrid authentication method provided by Microsoft Azure AD, allows users to log in to cloud applications directly using local AD credentials.

[0053] Kerberos is a network authentication protocol. Its core objective is to securely and reliably verify the identity of users in insecure network environments (such as the Internet or corporate intranets), ensuring that both communicating parties can be certain of each other's true identity.

[0054] SYSTEM is a built-in local security principal (account) in the Windows operating system. The SYSTEM account has the highest access and control over the entire computer. Its privilege level in the system is higher than any administrator account.

[0055] NTLM is an early network authentication protocol developed by Microsoft that uses a challenge / response mechanism to avoid directly transmitting passwords.

[0056] Hybrid cloud architecture has become the mainstream deployment solution for organizations with high security requirements, such as governments, military, and financial institutions, due to its elastic resource allocation and compliance adaptation capabilities. Deep integration between Azure AD and on-premises AD (on-premises refers to the target device) builds a unified identity plane across boundaries, achieving identity synchronization through mechanisms such as PTA and password hash synchronization, and can be extended to the cloud without rebuilding the permission system. However, the core risk of the identity system under a hybrid cloud architecture stems from the asymmetric design of the trust relationship between on-premises and the cloud. Azure AD and on-premises AD build a federated identity layer through a one-way synchronization mechanism. When attribute changes in on-premises AD are transmitted to the cloud via Azure AD Connect, cloud dynamic group rules automatically calculate membership and grant permissions based on these attributes.

[0057] When the local domain controller does not enable attribute modification auditing or the synchronization policy has lenient filtering conditions, low-privilege accounts can trigger the automatic inclusion logic of privileged containers in the cloud dynamic groups by tampering with extended attributes of themselves or associated objects. In other words, permission escalation can be achieved simply by modifying a few attributes in the local Active Directory (AD), and this operation only shows as a dynamic group membership change event in the Azure AD logs, making it difficult to trace the source of the local attribute tampering.

[0058] The stealth of this privilege escalation method benefits from the unquestionable trust mechanism of the hybrid identity architecture for synchronized data. The PTA service directly converts the authentication response from the local domain controller into a session token for Azure AD, but the cloud identity service does not perform secondary verification of the legitimacy of synchronized attributes. Therefore, when modifying some attributes by exploiting a privilege vulnerability on the local domain controller, Azure AD synchronizes the modification as the user's passwordless authentication key, thus bypassing MFA to directly generate a valid master refresh token. Since cloud conditional access policies typically only evaluate dynamic factors such as the IP address and device compliance status of the current session, and do not verify whether the key source conflicts with the original security policy of local AD, this privilege escalation operation appears in cloud logs as legitimate access from compliant devices and regular login locations, completely circumventing the real-time blocking mechanism based on risk scoring.

[0059] The existing methods for privilege escalation in hybrid cloud environments mainly include the following:

[0060] 1) Utilize Azure AD Connect to synchronize service account permissions

[0061] Exploiting Azure AD Connect synchronization service involves compromising on-premises AD accounts with Azure AD synchronization privileges, altering synchronization rules, or directly injecting high-privilege cloud roles into on-premises AD, forcing Azure AD Connect to synchronize malicious accounts to the cloud. Since cloud services trust the synchronization source, malicious users can use this to create cloud accounts with global administrative privileges, thereby gaining tenant-level control. For example, after gaining SYSTEM privileges through a local vulnerability, a malicious user can extract service account credentials from memory and elevate a regular user to a global administrator via the cloud API, achieving cross-environment privilege takeover.

[0062] 2) Forging using federated authentication tokens

[0063] In scenarios where AD Federation (AD FS) token forgery is used to forge authentication credentials between the on-premises AD and cloud services via AD FS federated authentication, malicious users can steal the on-premises AD domain controller privileges or the AD FS server's token signing certificate, forge a SAML token, and claim the user as a global administrator in the cloud. Because the cloud service trusts the on-premises federated authentication, it will directly grant the malicious user cloud administrator privileges.

[0064] 3) Abusing cloud API permissions by registering local applications

[0065] If a local application is registered with a cloud service (Azure AD application registration) and granted a high-privilege scope, malicious users can exploit the local low-privilege environment to steal application credentials and call the Microsoft Graph API through the application's identity to create a hidden cloud administrator account or modify the existing account's permissions, bypassing the user's identity to directly control the target.

[0066] 4) Utilize cloud-based management agents to achieve local privilege escalation.

[0067] After installation on the local server, the cloud management tool runs with high privileges by default and communicates with the cloud console. By exploiting local vulnerabilities to gain process control, tampering with its communication with the cloud, disguising its own operations as legitimate cloud commands, and leveraging role permissions to create a global administrator account in the cloud, it achieves privilege escalation.

[0068] Current hybrid cloud privilege escalation methods generally suffer from insufficient stealth, reliance on specific configuration vulnerabilities, and lengthy escalation chains. Utilizing Azure AD Connect synchronization service accounts requires direct manipulation of high-privilege accounts or modification of synchronization rules, easily triggering log alerts and relying on incorrect permission allocation by the enterprise. Federation authentication token forgery requires compromising the AD FS server or stealing certificates, making it difficult to implement and limited by the robustness of federated trust configurations. Abuse of local application registration requires the target application to be granted high-privilege scopes, which is difficult to achieve if the user organization strictly adheres to the principle of least privilege. Cloud management agent privilege escalation relies on the control of local agent processes, requiring bypassing protection mechanisms, and tampering with communication is easily intercepted by two-way authentication. All these methods require overcoming multiple layers of defense, leaving obvious traces and having limited adaptability.

[0069] The privilege escalation method proposed in this application aims to achieve a covert, universal, and efficient method by deeply integrating protocol-level vulnerabilities with the automation features of business logic. It does not rely on specific service account permissions or application registration vulnerabilities; it triggers automated authorization of cloud-based dynamic groups simply by tampering with local user attributes and forging Kerberos tickets. The privilege escalation chain is completely hidden within the normal attribute synchronization and policy execution process, evading log detection. Furthermore, this method only requires basic dynamic group functionality and weak Kerberos encryption support, making it suitable for most hybrid cloud environments and significantly lowering the barrier to entry for privilege escalation. Compared to traditional technologies, the new method transforms local low-privilege operations into cloud-based privileged control with a more streamlined approach, achieving breakthroughs in covertness, universality, and success rate.

[0070] Traditional privilege escalation methods are easily detected by log monitoring and real-time defense tools. However, this application hides privilege escalation behavior in seemingly legitimate operations by distributing the privilege escalation chain: from local attribute tampering to dynamic group authorization to ticket forgery. This effectively avoids security alerts based on single events and meets the high requirements of malicious users for concealment.

[0071] This application leverages the deep integration between local Active Directory (AD) and Azure Active Directory in a hybrid identity architecture. By blindly trusting local authentication results through the PTA service, it transforms low-privilege local operations into cloud privileges, thus solving the technical challenge that traditional privilege escalation methods cannot penetrate the hybrid trust chain.

[0072] like Figures 1 to 3 As shown, in a first aspect, this application provides an identity security protection method based on Azure AD control capabilities, including:

[0073] S100: Obtain the target device and modify the permissions of the target device through malicious process injection or registry key value tampering to obtain SYSTEM level privileges.

[0074] Specifically, obtaining SYSTEM level privileges may involve the following steps:

[0075] S101, exploiting an unpatched target device privilege escalation vulnerability in Windows systems to obtain initial execution privileges on the target device.

[0076] Specifically, the target device harbors unpatched vulnerabilities in the Windows system, such as service permission configuration vulnerabilities. Based on these vulnerabilities, initial privileges are gained through phishing email attachments, malicious web page scripts, and modified installation packages. The user is then lured into executing low-privilege malicious programs (such as macro viruses disguised as documents), exploiting system service flaws to escalate to ordinary administrator privileges. This grants non-SYSTEM level control, allowing access to system files and parts of the registry.

[0077] S102, based on the initial execution permissions of the target device, obtain SYSTEM level permissions by injecting a high-privilege process or modifying registry key values.

[0078] For example, injecting high-privilege processes: The process calls the Windows API `OpenProcess()` (a core API function provided by the Windows operating system used to obtain a handle to a specified process for subsequent operations such as reading / writing memory, terminating the process, and injecting code) to obtain the target process handle. It then uses `VirtualAllocEx()` (which dynamically allocates memory in the virtual address space of a specified process) to allocate space in the target process's memory and writes malicious code (such as privilege escalation shellcode—a highly concise, position-independent piece of machine code typically used for exploits, process injection, or privilege escalation)). Finally, it uses `CreateRemoteThread()` (a key Windows API function used to create a remote thread within the target process, enabling code execution within the target process's context) to create a new thread within the target process to execute the malicious code. The malicious code extracts the target process's SYSTEM token and copies it to the current attack session (using `DuplicateTokenEx()` (a key API in the Windows security model used to copy or upgrade existing access tokens)) to achieve privilege escalation. Finally, it obtains stable SYSTEM privileges.

[0079] For example, the system modifies registry keys: It tampers with service registry entries (such as HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MyService, a key path in the registry used to define and manage system services) and modifies ImagePath (a value under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\<service name> in the Windows registry, used to specify the path to the executable file corresponding to the service) to point to the malicious program. It then restarts the service (net stop MyService & net start MyService, a Windows command-line command combination used to quickly restart a system service named "MyService") or waits for the system to restart. The Services Manager (services.exe) loads the malicious program with SYSTEM privileges. It then gains stable SYSTEM privileges.

[0080] S200, using the SYSTEM level privileges, access the standard department attribute field of the target user object in AD, as well as the extended attribute field with permission mapping function in the hybrid cloud synchronization scenario, and modify it according to the preset conditions that conform to the cloud privileged dynamic group membership rules to obtain the tampered target user attributes.

[0081] Specifically, obtaining the attributes of a target user that has been tampered with may include the following steps:

[0082] S201 analyzes the rules of the msDS-CloudExtension Attribute metadata in the AD architecture to obtain matching rules.

[0083] Specifically, to configure dynamic group policies for a target device, it's necessary to understand its matching rules. This typically involves reverse engineering the metadata of the msDS-CloudExtension Attribute (a custom extension attribute in Microsoft Active Directory (AD), belonging to the msDS (Microsoft Directory Service) schema) within the Active Directory architecture to achieve rule matching. The target organization is the macro-level entity, referring to the enterprise cloud environment, which contains two key components: target device infrastructure (deploying the target device's AD domain controller, which manages user attributes); and cloud services (Azure AD dynamic group policies, which execute automated permission allocation). The specific rules configured by the enterprise in Azure AD (e.g., (user.extensionAttribute1 -eq "GlobalAdmin" (an LDAP / Active Directory query filter used to find user objects with the extensionAttribute1 attribute value "GlobalAdmin")) are needed to grant global administrator privileges).

[0084] For example, a dynamic group rule expression (such as user.extensionAttribute1 -eq "GlobalAdmin") is read from the Azure AD Connect configuration cache, and key conditional operators (eq) and thresholds ("GlobalAdmin") are extracted for analysis to form matching rules.

[0085] S202, according to the matching rules, using the SYSTEM level permissions, the standard department attribute field of the target user object in AD, and the extended attribute field with permission mapping function in the hybrid cloud synchronization scenario, are modified according to the preset conditions of the cloud privileged dynamic group membership rules, so as to obtain the tampered target user attributes.

[0086] Specifically, based on the list of matching rules, the AD object modification interface is called to assign a value to the specified department attribute of the target user object, while forging the whenChanged timestamp to match historical legitimate operations. The tampered user attribute has a value that meets the dynamic group privilege granting conditions (such as extensionAttribute1="GlobalAdmin"), and no real-time alarm is triggered.

[0087] First, by exploiting SYSTEM-level privileges to bypass access restrictions, protected attribute fields in Active Directory (including standard department attributes and permission mapping extension attributes) are modified, bypassing conventional auditing mechanisms. Second, precise rule adaptation is performed, setting the target attribute value to a preset privilege trigger condition based on dynamic group policy configuration (e.g., (user.extensionAttribute1 -eq "GlobalAdmin")). Finally, covert safeguards are implemented, including forging timestamps to disguise tampering records as historical operations and real-time backup of original values ​​to support rapid rollback, ensuring that the operation does not trigger security alerts.

[0088] These three mechanisms ensure that the altered user attributes comply with the access rules of the cloud-based privileged dynamic group, laying the foundation for subsequent automated permission upgrades.

[0089] S300 utilizes the Azure AD Connect synchronization service to upload the tampered target user attributes to Azure AD via the API channel in a compliant protocol format and mark it as an attribute update event, thus confirming that the abnormal data stream conforms to the characteristics of normal business synchronization.

[0090] Specifically, determining whether an abnormal data stream conforms to the characteristics of normal business synchronization may include the following steps:

[0091] S301. Using the SYSTEM level privileges, hijack the Azure AD Connect synchronization service, or call the Start-ADSyncSync Cycle PowerShell command to force the start of the incremental synchronization cycle and obtain synchronization instructions.

[0092] Specifically, by operating Azure AD Connect service components with SYSTEM privileges, an incremental synchronization cycle is forcibly triggered. A synchronization instruction queue is generated, containing data packets whose attributes have been tampered with.

[0093] For example, a service hijacking method:

[0094] Service control includes calling the Windows Service Management API (sc.exe) to restart the synchronization service; and using PowerShell module commands to force synchronization.

[0095] Azure AD Connect automatically synchronizes every 30 minutes by default. Forced startup bypasses the waiting period and pushes tampered data immediately.

[0096] S302, according to the synchronization instruction, the tampered target user attributes will be uploaded to Azure AD through the Microsoft Graph API channel in a compliant DirSync protocol format and marked as a cloudAnchor attribute update event, confirming that the abnormal data stream conforms to the characteristics of normal business synchronization.

[0097] Specifically, the tampered attributes are encapsulated in DirSync protocol format and uploaded via the Microsoft Graph API channel, marked as a cloudAnchor attribute update event. The abnormal data stream is identified as having normal business synchronization characteristics, and Azure AD completes the attribute update. Here, cloudAnchorUpdate is a predefined legitimate event type in Azure AD, directly inheriting from synchronization metadata and bypassing anomaly flag detection.

[0098] S400: Based on the NTLM hash of the target user account of the target device, a Kerberos ticket is constructed using the Kerberos client library to obtain a forged ticket.

[0099] Specifically, obtaining counterfeit documents may include the following steps:

[0100] Based on the NTLM hash of the target user account of the target device, the core functions of the Kerberos client library are used to construct a Kerberos ticket according to the Kerberos protocol specification, resulting in a KerberosSilver Ticket forgery with a service subject name binding.

[0101] The Kerberos Silver Ticket forgery involves altering key fields: setting the user principal name to a high-privilege administrator account, extending the ticket validity period to the maximum allowed threshold, and specifying the service category as the hybrid authentication core service.

[0102] It should be noted that the NTLM hash value of the target user account is used as the basic encryption material. The NTLM hash is a core credential of the Windows authentication system, obtained through memory extraction or registry cracking. This hash value serves a dual purpose in key generation: it acts as both the key source for encrypting the ticket content and a cryptographic bridge binding the target user to a forged identity.

[0103] The ticket construction is completed in the Kerberos client library: the protocol parsing function implements the standard framework, the subject identification function handles the encoding conversion of the User Principal Name (UPN) and Service Principal Name (SPN), and the timestamp engine ensures the generation of time series that conforms to the Kerberos time window. This process constructs the original ticket framework, laying the technical foundation for tampering with key fields.

[0104] The core of the attack capability is to implement precise tampering on the ticket framework. The CNAME field (a record type in DNS (Domain Name System) used to map one domain name (alias) to another domain name (canonical name) to achieve indirect domain name resolution) on the ticket is replaced with a high-privilege administrator account. By copying the historical characteristics of the security identifier of the legitimate administrator, the forged identity can pass the deep verification of the PTA service. At the same time, the SNAME field (a term in the Kerberos authentication protocol, referring to the username part of the Service Principal Name (SPN)) is fixed to the Hybrid Authentication Service Identifier, ensuring that the ticket is recognized as a legitimate credential for Azure authentication.

[0105] By deconstructing the Kerberos protocol implementation mechanism, NTLM hashes are transformed into encrypted tokens with high-privilege claims, enabling the complete target device implementation of the attack chain and the precise utilization of the hybrid cloud trust chain.

[0106] In S500, after Azure AD completes attribute synchronization, the cloud-based dynamic group membership engine evaluates and modifies the target user's attributes. The target user account is then dynamically added to the associated global administrator role group, resulting in a target user account with a global administrator session token.

[0107] Specifically, obtaining a target user account with a global administrator session token may include the following steps:

[0108] S501: After Azure AD completes attribute synchronization, it uses the cloud-based dynamic group membership engine to assess the tampering of target user attributes, and the target user account is dynamically added to the associated global administrator role group.

[0109] Specifically, once the tampered user attribute (such as extensionAttribute1="GlobalAdmin") is synchronized with Azure AD, the Dynamic Group Membership Engine is automatically activated by the attribute update event (cloudAnchorUpdate). This engine scans the changed data and matches the attribute values ​​against preset rules (such as (user.extensionAttribute1 -eq "GlobalAdmin")). The matching process can employ precise string comparison logic (case-sensitive) and supports joint determination of multiple rules (such as simultaneously verifying department attributes).

[0110] If the rule is met, the system will execute the role-based access control policy, adding the target user account to the global administrator role group (ObjectID: 62e90394-69f5-4237-9190-012177145e10). This process is automated, and the permission change log is marked as a system operation event, with the operation subject displayed as "Dynamic Group Policy Service," thus avoiding traces of manual intervention. Finally, the system outputs the global administrator role group membership, laying the foundation for token generation.

[0111] S502, based on the global administrator role group, the Azure AD identity provider issues a session token to obtain the target user account with the global administrator session token.

[0112] Specifically, based on the already activated global administrator role group, when a target user logs in through the PTA authentication channel, the Azure AD identity provider generates a session token in real time.

[0113] For example, the session token can be encrypted and signed using the RS256 algorithm to prevent tampering, while also being bound to the device compliance status and login IP geofence. This token supports instant permission inheritance—dynamic group permission changes take effect without re-authentication, and service chaining can be achieved through the delegation field.

[0114] Finally, a global administrator session token is output, granting administrative capabilities (such as creating users, modifying policies, and exporting data).

[0115] A complete automated chain is formed from attribute synchronization to session token activation: attribute matching triggers dynamic group policy execution, group member identities activate token permission claims, and the two are deeply coupled through the Azure RBAC mechanism. The entire permission escalation process appears as a system-driven action: attribute changes are recorded as compliance synchronization events, group member flags are added for automatic policy execution, and token generation is hidden within the standard authentication protocol. It is suitable for standard Azure hybrid cloud architectures and relies on the dynamic group feature and the default PTA service configuration.

[0116] S600, under the target user account with a global administrator session token, logs into the PTA service channel using the forged ticket and gains control over Azure AD.

[0117] Specifically, gaining control over Azure AD can include the following steps:

[0118] S601 uses a forged Kerberos Silver Ticket to initiate a login request through the PTA service channel and obtains a global administrator session token incorrectly granted by Azure AD.

[0119] Specifically, a forged Kerberos Silver Ticket (containing a modified user principal name set to a high-privilege administrator account, a ticket validity period extended to the maximum allowed threshold, and a service category specified as the Hybrid Authentication Core Service) is used to initiate a login request to the Direct Authentication (PTA) service. This ticket is loaded into the current session via memory injection, circumventing file scan detection.

[0120] The PTA service performs only basic verifications during the authentication process: verifying the validity of the ticket's encrypted signature and checking if the timestamp deviation is within the protocol's tolerance threshold. Because the PTA service trusts the authentication result of the target device's AD domain controller by default and does not perform secondary verification of the synchronization attribute's authenticity, the Azure AD identity provider incorrectly identifies this request as a legitimate high-privilege login operation, thus generating a global administrator session token. This session token may contain permission claims: granting global administrator status, granting full control over the directory, and binding the target user's UPN identifier to ensure operation traceability.

[0121] S602 uses a global administrator session token to call the Microsoft Graph API, perform high-risk privileged operations, and gain control over Azure AD.

[0122] Specifically, after obtaining a global administrator session token, tenant-level management operations can be performed through the Microsoft Graph API. This allows for high-risk privileged operations, namely, control over Azure AD.

[0123] like Figure 2 As shown, the overall process of an identity security protection method based on Azure AD control capabilities is as follows:

[0124] 1. Attribute tampering stage: Start, local privilege escalation: exploiting vulnerabilities to obtain SYSTEM privileges, tampering with AD user attributes: modifying department or extensionAttribute.

[0125] 2. Forged Ticket Stage: Extract the computer account NTLM hash, generate a Kerberos Silver Ticket, and inject the ticket into the memory session.

[0126] 3. Triggering the authorization phase: Triggering attribute synchronization, manual forced synchronization - calling Azure AD Connect for synchronization, waiting for automatic synchronization - 30-minute synchronization cycle, cloud dynamic group rule evaluation, user added to the global administrator group, logging into the cloud via PTA authentication, exercising GA privileges: creating users / modifying policies, attack completed.

[0127] In summary, this application provides an identity security protection method based on Azure AD control capabilities, which has the following beneficial effects:

[0128] This application aims to achieve covert privilege escalation from low-privilege users on the target device (AD) to global administrators in the cloud by deeply integrating the Kerberos protocol vulnerability of the target device with the dynamic group policy automation mechanism of Azure AD. The core idea is to exploit the logical separation between authentication and permission allocation in a hybrid cloud environment: the Kerberos protocol on the target device AD ​​is vulnerable to ticket forgery due to its support for weak encryption algorithms, while cloud-based dynamic groups automatically allocate permissions based on synchronized user attributes, and the Direct Authentication (PTA) service trusts the authentication results of the target device by default. A malicious user escalates privileges on the target device, tampering with user attributes and triggering dynamic group rules to automatically grant privileged roles in the cloud; simultaneously, they forge a Kerberos Silver Ticket to bypass authentication checks between the target device and the cloud, causing the PTA service to mistakenly identify the malicious user as a legitimate high-privilege user. In this process, the privilege escalation is dispersed across multiple stages, including target device attribute changes, ticket forgery, attribute synchronization, and dynamic group authorization. A single log event cannot correlate the entire privilege escalation process, thus evading detection by traditional security monitoring tools. The key to this solution lies in combining the protocol-level vulnerability of Kerberos weak encryption with the over-automation of dynamic groups due to business logic defects, forming a seamless privilege escalation link across environments.

[0129] Compared to traditional hybrid cloud privilege escalation techniques, this method offers significant improvements in terms of concealment, versatility, and operational efficiency.

[0130] The improvement in concealment is reflected in the deep concealment of privilege escalation traces and the log deception mechanism. Traditional privilege escalation techniques usually require explicit manipulation of the cloud console or API interface to modify permissions. Such operations directly generate high-risk permission change records in the cloud service provider's audit logs, which are easily captured by the audit logs. This method innovatively utilizes the automated authorization mechanism of dynamic groups in hybrid cloud architecture. By tampering with the target device's identity attributes and synchronizing them with the dynamic group membership in the cloud, it triggers the cloud service provider's preset permission allocation policy. There is no need to directly modify the cloud permission configuration during the privilege escalation process; all operations are disguised as policy execution flows that conform to business logic. At the same time, combined with the trust chain abuse technology in the PTA authentication system, by forging identity tokens with legitimate attributes, the cloud server recognizes the privilege escalation behavior as a regular operation that conforms to the security policy. This dual concealment mechanism causes the cloud audit logs to only record legitimate permission allocation events triggered by dynamic group membership changes. The core attack steps that occur in the target device system, such as attribute tampering and ticket forgery, are scattered across multiple subsystems such as the identity provider, directory service, and log system, and lack cross-system contextual analysis capabilities, making it difficult for conventional security detection rules to identify abnormal behavior.

[0131] The improvement in versatility stems from the universal utilization of the characteristics of hybrid cloud infrastructure. Traditional privilege escalation techniques heavily rely on specific configuration flaws in the target environment. Such techniques are often limited by the functionality of a particular cloud service provider or the customer's security configuration level, and the success rate of the attack is strongly correlated with the target environment. This method, however, deeply deconstructs the hybrid cloud identity synchronization mechanism, requiring only that the target system enable basic functions such as dynamic group membership management and target device directory service attribute synchronization, which are default or necessary configurations in most hybrid cloud deployments. It does not require any special misconfigurations or known vulnerabilities on the target, but achieves privilege escalation through unconventional combinations of legitimate functional components. This technical characteristic significantly expands the applicability of privilege escalation methods, making them effective against cloud environments with standard security baseline configurations.

[0132] The improvement in operational efficiency is primarily based on compressing the privilege escalation chain. Traditional privilege escalation techniques typically require malicious users to maintain access to the system for extended periods, gradually increasing privilege levels through repeated attempts at cross-account role-playing, permission policy enumeration, or credential brute-force. Such operations not only generate a large number of abnormal login logs but also significantly increase the risk of detection by real-time defense systems due to the excessively long cycle. This method integrates the separate stages of permission acquisition, maintenance, and escalation in the traditional privilege escalation chain into a highly coordinated three-step operation: "attribute tampering to ticket forgery to authorization triggering." First, attribute modification permissions are obtained on the target device system through memory injection or registry tampering. Then, user attributes matching the dynamic group member criteria are forged, and directory service synchronization is forcibly triggered. Finally, the automated authorization mechanism for dynamic group members provided by the cloud service provider is used to achieve permission jump. The entire privilege escalation process can be completed in a short time without leaving a persistent backdoor on the target system.

[0133] This application reveals the risk chain of abnormal privilege escalation in hybrid cloud environments by reproducing the attack path of "combining Kerberos weak encryption vulnerability with cloud dynamic policies". This method provides cloud service providers and security vendors with a verifiable attack behavior reproduction scheme, supporting the construction of more robust identity security protection mechanisms.

[0134] like Figure 2 and Figure 3 As shown, in a second aspect, this application provides an identity security protection system based on Azure AD control capabilities, applied to the aforementioned identity security protection method based on Azure AD control capabilities, and applicable to a hybrid synchronization layer. The system includes:

[0135] The local privilege escalation and attribute tampering module is used to obtain the target device and tamper with the permissions of the target device through malicious process injection or registry key values ​​to obtain SYSTEM level privileges.

[0136] The local privilege escalation and attribute tampering module is also used to utilize the SYSTEM level privileges to access the standard department attribute field of the target user object in AD, as well as the extended attribute field with permission mapping function in the hybrid cloud synchronization scenario, to modify the target user attributes in accordance with the preset conditions of the cloud privileged dynamic group membership rules.

[0137] The local privilege escalation and attribute tampering module is also used to utilize the Azure AD Connect synchronization service to upload the tampered target user attributes to Azure AD via the API channel in a compliant protocol format, and mark it as an attribute update event, to determine that the abnormal data stream conforms to the characteristics of normal business synchronization.

[0138] The Kerberos ticket forgery module is used to construct a Kerberos ticket using the Kerberos client library based on the NTLM hash of the target user account of the target device, and obtain a forged ticket.

[0139] The Attribute Synchronization and Dynamic Group Triggering Module is used to evaluate and modify the target user's attributes after Azure AD completes attribute synchronization. The target user account is then dynamically added to the associated global administrator role group, resulting in a target user account with a global administrator session token.

[0140] The PTA authentication and cloud control module is used to log in to the PTA service channel using the forged ticket under the target user account with a global administrator session token, and obtain Azure AD control capabilities.

[0141] By leveraging Azure AD's control capabilities, cloud service providers and security vendors can develop verifiable attack behavior reproduction solutions, thereby building an identity security protection mechanism.

[0142] Specifically, the structural design of this application revolves around cross-environment collaborative vulnerability exploitation, and constructs a modular system for multi-environment collaboration. Its core architecture includes a local privilege escalation and attribute tampering module, a Kerberos ticket forgery module, an attribute synchronization and dynamic group triggering module, and a PTA authentication and cloud control module.

[0143] The local privilege escalation and attribute tampering module is responsible for exploiting Windows kernel privilege escalation vulnerabilities to break the user-mode isolation mechanism. It hijacks the process token allocation process by hooking the system service scheduler, achieving privilege escalation from ordinary users to SYSTEM privileges. It then calls the Active Directory (AD) management interface to modify user attributes, ensuring compliance with cloud-based dynamic group rules and bypassing the target device's AD access control list permission verification. It selects extended attributes with cloud-based permission mapping value for targeted tampering, encoding privilege markers into attribute values ​​to ensure that tampering does not trigger sensitive attribute change alerts in AD audit policies. Finally, it implants a backdoor service using registry mirroring techniques to maintain continuous control over AD attributes.

[0144] The Kerberos ticket forgery module relies on Kerberos protocol parsing and encryption algorithm reverse engineering. By parsing the domain controller's encryption algorithm, it reproduces a valid Silver Ticket. It needs to construct the user identifier, service name, and timestamp fields in the ticket to pass PTA service verification. User identifier forgery mainly uses a security identifier history injection technique to perform a bitwise OR operation between the target user and the privileged group's security identifier to construct a hybrid identity. The service subject name is set to a cloud-based PTA service-specific identifier to facilitate the service name construction process. Finally, the network time protocol ensures precise synchronization between the ticket timestamp and the domain controller's time source, circumventing Kerberos time deviation detection.

[0145] The attribute synchronization and dynamic group triggering module constructs a two-way synchronization monitoring system to monitor the synchronization cycle of Azure AD Connect, hijack the Sync Scheduler service in Azure AD Connect, and force-trigger synchronization operations, keeping synchronization traffic within normal business thresholds. Subsequently, by injecting forged markers into the metadata, the cloud identifies malicious attribute changes as legitimate incremental updates. Then, by sending forged group membership assessment requests, it prematurely triggers the cache refresh mechanism of the dynamic group rule engine (Azure AD's core automated policy enforcement module, dedicated to real-time evaluation of user attributes and dynamic permission allocation). After synchronization is complete, the attribute synchronization and dynamic group triggering module verifies whether the target user has successfully joined the global administrator group and clears abnormal operation records from the synchronization service event log.

[0146] The PTA authentication and cloud control module primarily enables the covert execution of privileged operations in the cloud. By hijacking the OAuth token in the hybrid authentication process, it tampers with the audience claim of the JWT token during the PTA service verification phase, redirecting it to the Microsoft Graph API service. Simultaneously, it constructs an operation sequence generator based on a Markov chain to deeply simulate the historical behavior patterns of the target tenant administrator, achieving covert execution of privileged operations. During the operation implementation phase, the module employs a time-dispersion algorithm to break down high-risk instructions into multiple low-suspicion standardized API calls, such as first performing a directory role read and then creating a new user group. It also utilizes the streaming multiplexing feature of the HTTP / 2 protocol to mix these requests with normal management traffic, effectively circumventing anomaly detection rules based on single requests. In the final control phase, a persistent channel is established through a service subject delegation mechanism to ensure that malicious users maintain covert control over the cloud environment even after permission changes.

[0147] The algorithms mentioned above are all conventional algorithms. This application does not improve the algorithms themselves, such as Markov chains, time-dispersed algorithms, etc.

[0148] It should be noted that the description of the system can be found in the method description, and will not be repeated here.

[0149] like Figure 3 As shown, Figure 3 In the diagram, solid arrows represent immediate attack operations initiated by the attacker, while dashed arrows represent indirect data flows that rely on system mechanisms. In an identity security protection system based on Azure AD control capabilities, the hybrid synchronization layer serves as the initial entry point for the attack process, responsible for coordinating the permission synchronization mechanisms between local AD and the cloud (such as Azure AD).

[0150] Thirdly, this application provides a computer storage medium storing a computer program thereon, which, when executed by a processor, implements the steps of the aforementioned identity security protection method based on Azure AD control capabilities.

[0151] Fourthly, this application provides a computer program that, when executed by a processor, implements the steps of the aforementioned identity security protection method based on Azure AD control capabilities.

[0152] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), Rambus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0153] The various embodiments in this disclosure are described in a progressive manner. The same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on describing the differences from other embodiments.

[0154] The scope of protection of this disclosure is not limited to the embodiments described above. Obviously, those skilled in the art can make various modifications and variations to this disclosure without departing from its scope and spirit. If such modifications and variations fall within the scope of the claims of this disclosure and their equivalents, then the intent of this disclosure also includes such modifications and variations.

Claims

1. An identity security protection method based on Azure AD control capabilities, characterized in that the method... include: The system acquires the target device and modifies its permissions via malicious process injection or registry key tampering to obtain SYSTEM-level privileges. Using the SYSTEM level privileges, the standard department attribute field of the target user object in AD, as well as the extended attribute field with permission mapping function in the hybrid cloud synchronization scenario, are accessed to modify the target user attributes in accordance with the preset conditions of the cloud privileged dynamic group membership rules. Using Azure AD Connect synchronization service, the modified target user attributes are uploaded to Azure AD via API channel in a compliant protocol format and marked as attribute update events to determine that the abnormal data stream conforms to the characteristics of normal business synchronization. Based on the NTLM hash of the target user account of the target device, a Kerberos ticket is constructed using the Kerberos client library to obtain a forged ticket; Once Azure AD completes attribute synchronization, the cloud-based dynamic group membership engine evaluates and modifies the target user's attributes. The target user account is then dynamically added to the associated global administrator role group, resulting in a target user account with a global administrator session token. Under the target user account with the global administrator session token, the forged ticket is used to log in to the PTA service channel and gain control over Azure AD. By leveraging Azure AD control capabilities, cloud service providers and security vendors can obtain verifiable solutions for reproducing attack behaviors and build identity security protection mechanisms.

2. The identity security protection method based on Azure AD control capabilities according to claim 1, characterized in that, The process of acquiring the target device and obtaining SYSTEM-level privileges by injecting malicious processes or modifying registry keys includes the following steps: By exploiting an unpatched target device privilege escalation vulnerability in Windows systems, initial execution privileges were obtained on the target device. Based on the initial execution permissions of the target device, SYSTEM level permissions are obtained by injecting a high-privilege process or modifying registry key values.

3. The identity security protection method based on Azure AD control capabilities according to claim 1, characterized in that, The step of using the SYSTEM level privileges to access the standard department attribute field of the target user object in AD, and the extended attribute field with permission mapping function in the hybrid cloud synchronization scenario, to modify the target user attributes according to preset conditions that conform to the cloud privileged dynamic group membership rules, includes: Analyze the rules of the msDS-CloudExtension Attribute metadata in the AD architecture to obtain matching rules; According to the matching rules, using the SYSTEM level permissions, the standard department attribute field of the target user object in AD, as well as the extended attribute field with permission mapping function in the hybrid cloud synchronization scenario, are modified according to the preset conditions of the cloud privileged dynamic group membership rules, so as to obtain the tampered target user attributes.

4. The identity security protection method based on Azure AD control capabilities according to claim 1, characterized in that, The steps of utilizing Azure AD Connect synchronization service to upload the tampered target user attributes to Azure AD via API channel in a compliant protocol format and mark it as an attribute update event, and determining that the abnormal data stream conforms to the characteristics of normal business synchronization, include: Using the aforementioned SYSTEM level privileges, the Azure AD Connect synchronization service can be hijacked, or the Start-ADSyncSync Cycle PowerShell command can be invoked to force the start of an incremental synchronization cycle and obtain synchronization instructions. According to the synchronization instructions, the tampered target user attributes will be uploaded to Azure AD via the Microsoft Graph API channel in a compliant DirSync protocol format and marked as a cloudAnchor attribute update event, confirming that the abnormal data stream conforms to the characteristics of normal business synchronization.

5. The identity security protection method based on Azure AD control capabilities according to claim 1, characterized in that, The step of constructing a Kerberos ticket using a Kerberos client library based on the NTLM hash of the target user account of the target device to obtain a forged ticket includes: Based on the NTLM hash of the target user account of the target device, the core functions of the Kerberos client library are used to construct a Kerberos ticket according to the Kerberos protocol specification, resulting in a Kerberos Silver Ticket forged ticket with a service subject name binding. The Kerberos Silver Ticket forged ticket includes key field tampering: the user subject name is set to a high-privilege administrator account, the ticket validity period is extended to the maximum allowed threshold, and the service category is specified as the hybrid authentication core service.

6. The identity security protection method based on Azure AD control capabilities according to claim 1, characterized in that, The steps described above, whereby after Azure AD completes attribute synchronization, the cloud-based dynamic group membership engine evaluates and modifies the target user's attributes, and the target user account is dynamically added to the associated global administrator role group, resulting in a target user account with a global administrator session token, include: Once Azure AD completes attribute synchronization, the cloud-based dynamic group membership engine is used to assess the tampering with the target user's attributes, and the target user account is dynamically added to the associated global administrator role group. Based on the global administrator role group, the Azure AD identity provider issues a session token to obtain the target user account with the global administrator session token.

7. The identity security protection method based on Azure AD control capabilities according to claim 1, characterized in that, The steps of logging into the PTA service channel using the forged ticket under the target user account with a global administrator session token to obtain Azure AD control capabilities include: Using a forged Kerberos Silver Ticket, a login request was initiated through the PTA service channel, and a global administrator session token was mistakenly granted by Azure AD; By using a global administrator session token to call the Microsoft Graph API, high-risk privileged operations can be performed to gain control over Azure AD.

8. An identity security protection system based on Azure AD control capabilities, characterized in that, The identity security protection method based on Azure AD control capabilities, applied to any one of claims 1 to 7, comprises: The local privilege escalation and attribute tampering module is used to obtain the target device and tamper with the permissions of the target device through malicious process injection or registry key values ​​to obtain SYSTEM level privileges. The local privilege escalation and attribute tampering module is also used to utilize the SYSTEM level privileges to access the standard department attribute field of the target user object in AD, as well as the extended attribute field with permission mapping function in the hybrid cloud synchronization scenario, to modify the target user attributes in accordance with the preset conditions of the cloud privileged dynamic group membership rules. The local privilege escalation and attribute tampering module is also used to utilize the Azure AD Connect synchronization service to upload the tampered target user attributes to Azure AD via the API channel in a compliant protocol format, and mark it as an attribute update event, to determine that the abnormal data stream conforms to the characteristics of normal business synchronization. The Kerberos ticket forgery module is used to construct a Kerberos ticket using the Kerberos client library based on the NTLM hash of the target user account of the target device, and obtain a forged ticket. The Attribute Synchronization and Dynamic Group Triggering Module is used to evaluate and modify the target user's attributes after Azure AD completes attribute synchronization. The target user account is then dynamically added to the associated global administrator role group, resulting in a target user account with a global administrator session token. The PTA authentication and cloud control module is used to log in to the PTA service channel using the forged ticket under the target user account with a global administrator session token, and obtain Azure AD control capabilities. By leveraging Azure AD control capabilities, cloud service providers and security vendors can obtain verifiable solutions for reproducing attack behaviors and build identity security protection mechanisms.

9. A computer storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the identity security protection method based on Azure AD control capabilities as described in any one of claims 1 to 7.

Images