CloudSec Wine on Telegram: “🔷 Spoofing Azure AD sign-ins logs by imitating…”

CloudSec Wine @cloud_sec · 2.27K subscribers

Post #182 726 Aug 30, 2021, 08:38 UTC

🔷 Spoofing Azure AD sign-ins logs by imitating AD FS Hybrid Health Agent

How anyone with a local administrator access to AD FS server (or proxy), can create arbitrary sign-ins events to Azure AD sign-ins log.

https://o365blog.com/post/hybridhealthagent/

#azure

O365Blog Spoofing Azure AD sign-ins logs by imitating AD FS Hybrid Health Agent Azure AD Connect Health is a feature that allows viewing the health of on-prem hybrid infrastructure components, including Azure AD Connect and AD FS servers. Health information is gathered by agents installed on each on-prem hybrid server. Since March 2021…

Open in Telegram All posts from @cloud_sec