Hybrid Identity

ATT&CK T1556.007

Adversaries may patch, modify, or otherwise backdoor cloud authentication processes that are tied to on-premises user identities in order to bypass typical authentication mechanisms, access credentials, and enable persistent access to accounts. Many organizations maintain hybrid user and device identities that are shared between on-premises and cloud-based environments. These can be maintained in a number of ways. For example, Microsoft Entra ID includes three options for synchronizing identities between Active Directory and Entra ID(Citation: Azure AD Hybrid Identity): * Password Hash Synchro

Category: Technique, defense-impairment, persistence, credential-access

MITRE ATT&CK: T1556.007

Reference: MITRE ATT&CK T1556.007