Skip to content
Threat Feed
Subscribe

Tag

Azure Ad

7 briefs RSS
high advisory

Detection of ConvertTo-AADIntBackdoor PowerShell Cmdlet Execution

The execution of the ConvertTo-AADIntBackdoor PowerShell cmdlet indicates an attempt to compromise Azure AD federation settings to enable unauthorized token generation and persistent access.

Azure Active Directory azure-ad persistence privilege-escalation powershell identity-security
1r 2t
critical advisory

CVE-2026-33843 Authentication Bypass in Microsoft Azure Active Directory B2C

CVE-2026-33843 allows an unauthorized attacker to elevate privileges over a network in Microsoft Azure Active Directory B2C due to an authentication bypass using an alternate path or channel.

Azure Active Directory B2C authentication-bypass privilege-escalation azure-ad cloud
2r 1t 1c
medium advisory

EntraFalcon Security Posture Assessment Tool

EntraFalcon is a security tool designed to enumerate and assess the security posture of Entra ID tenants, identifying misconfigurations and vulnerabilities related to users, groups, applications, roles, PIM settings, and Conditional Access policies.

Entra ID entra-id azure-ad security-assessment misconfiguration cloud-security
2r 3t 2i
critical advisory

Detection of ConvertTo-AADIntBackdoor Execution via PowerShell

This brief outlines the detection of the ConvertTo-AADIntBackdoor command execution via PowerShell Script Block Logging, a technique used to create a backdoor in federated Azure AD domains by modifying federation settings and allowing attackers to control the authentication process.

Azure Active Directory azure-ad backdoor powershell persistence privilege-escalation
2r 4t
medium advisory

O365 Email Access By Security Administrator

Atypical access to O365 mailboxes is detected when a security administrator uses Threat Explorer features to directly view email, potentially indicating reconnaissance or data exfiltration by a compromised or malicious insider.

Office 365 cloud o365 data exfiltration azure ad
2r 2t
high threat

Azure AD Multiple Service Principals Created by Single Principal

A single compromised Azure AD service principal can create multiple new service principals in a short time frame to establish persistence and facilitate lateral movement within the cloud environment.

NOBELIUM Group azure-ad service-principal persistence
2r 1t
high advisory

Azure AD Service Principal Privilege Escalation

An Azure Active Directory (Azure AD) Service Principal elevates its own privileges by adding itself to a new application role assignment, potentially leading to unauthorized access and control within the Azure environment.

azure azure-ad service-principal privilege-escalation
2r 1t