Skip to content
Threat Feed

Tag

Identityfederation

1 brief RSS
high advisory

Azure AD User ImmutableId Attribute Modification for Persistence

The following analytic identifies modifications to the SourceAnchor (ImmutableId) attribute for an Azure Active Directory user, which is a step in setting up an Azure AD identity federation backdoor that allows an attacker to impersonate any user and bypass MFA.

Splunk Enterprise +3 azuread persistence identityfederation backdoor cloud
2r 1t