Hybrid Active Directory (AD) is the new workhorse to manage single user identity for both authentication and authorization in on-premises and cloud environments. Hybrid AD environments are of interest to threat actors and defenders alike.

Through our experience in performing incident response and remediation engagements across the globe, we observed various backdoors and misconfigurations in hybrid AD that provided threat actors long term at will privileged access to organizations’ IT environments.

We will cover techniques used by threat actors to maintain persistence, covertly elevate privileges at will, and to maintain and exert control over systems managed by hybrid AD. We will share different hypotheses and hunting techniques to detect misconfigurations and backdoors in a hybrid AD environment.