Attack Chain

1. The attacker gains initial access to an account with sufficient privileges to modify Azure AD user attributes.
2. The attacker identifies a target user account within the Azure AD tenant.
3. The attacker modifies the SourceAnchor (ImmutableId) attribute of the target user's account using Azure AD PowerShell or the Azure portal.
4. The attacker configures a malicious Security Assertion Markup Language (SAML) identity provider.
5. The attacker crafts a SAML assertion with the target user's ImmutableId and signs it with the malicious identity provider.
6. The attacker uses the crafted SAML assertion to authenticate to Azure AD as the target user, bypassing password and MFA requirements.
7. The attacker gains unauthorized access to resources and data within the Azure AD environment.
8. The attacker maintains persistent access to the compromised user account, even if the user's password is changed or MFA is enabled.

Impact

Successful modification of the ImmutableId attribute allows attackers to bypass password and MFA protections, leading to full account compromise. An attacker with the ability to impersonate a privileged user can escalate privileges, access sensitive data, and disrupt critical business operations. This can lead to data breaches, financial loss, and reputational damage.

Recommendation

• Deploy the Sigma rule Azure AD User ImmutableId Attribute Updated to your SIEM and tune for your environment.
• Enable Azure AD audit logging and monitor for "Update user" operations targeting the SourceAnchor attribute.
• Investigate any modifications to the SourceAnchor attribute, especially those performed by unfamiliar or unauthorized accounts.
• Review and harden Azure AD federation settings to prevent the use of malicious SAML identity providers.
• Monitor and investigate user accounts identified in the RBA message in the alert description.