How Hackers Persist & Privesc in Microsoft 365

This video demonstrates how attackers can exploit dynamic groups in Entra ID to maintain persistence and escalate privileges in Microsoft 365 environments 0:00.

Key Takeaways:
• Entra ID contains two types of groups: Microsoft 365 groups for application access and security groups for resource control, both of which can be exploited by attackers 3:07.
• Dynamic groups automatically add users based on predefined rules and require a Microsoft Entra ID P1 license, creating a potential attack vector when improperly configured 3:45.
• Using Graph Runner, attackers can automate post-exploitation activities against Microsoft Graph API after gaining initial access through phishing 9:10.
• Attackers can invite guest accounts with usernames that match dynamic group rules, causing automatic addition to privileged groups for privilege escalation 16:04.
• Security group cloning creates confusion by duplicating groups with identical names, potentially leading administrators to accidentally grant permissions to malicious groups 22:19.

Defensive measures include restricting users' ability to create security groups and limiting guest user invitation capabilities to prevent these attack vectors 25:17.

Sources:

• 0:00 Introduction to persistence and privilege escalation in Entra ID
• 3:07 Explanation of different group types in Entra ID
• 3:45 Dynamic groups and their licensing requirements
• 9:10 U