Skip to content
Threat Feed

Tag

Azure-Ad

1 brief RSS
critical advisory

Detection of ConvertTo-AADIntBackdoor Execution via PowerShell

This brief outlines the detection of the ConvertTo-AADIntBackdoor command execution via PowerShell Script Block Logging, a technique used to create a backdoor in federated Azure AD domains by modifying federation settings and allowing attackers to control the authentication process.

Azure Active Directory azure-ad backdoor powershell persistence privilege-escalation
2r 4t