ENTRA CONNECT ATTACKER TRADECRAFT: PART 2

Summary from the TLDR InfoSec newsletter

This post discusses how to exploit Entra Connect Sync to add credentials to a user in another domain within the same Entra tenant, despite having limited privileges. A link can be established to a targeted on-premises user account by creating a new Entra user with a matching sourceAnchor. This attack can be prevented by identifying partially synced users and privileged accounts inheriting permissions from the Users OU.