Skip to content
Hermes Codex

Azure AD Connect / Entra ID Connect: The Hybrid Attack Bridge

Concept

Section titled “Concept”

Microsoft Entra Connect (formerly Azure AD Connect) is the enterprise synchronization engine that replicates on-premise Active Directory objects and authentication secrets into the Microsoft Entra ID cloud tenant.

It relies on three foundational components:

  1. The On-Premise Active Directory Synchronization Account (MSOL_XXXXX): Automatically provisioned at the root of the local domain, this account holds directory Extended Replication Rights (DS-Replication-Get-Changes-All) to harvest NTLM hashes for Password Hash Synchronization (PHS).
  2. The Cloud Synchronization Account (Sync_XXXXX): A high-privilege service account provisioned in Entra ID holding the Directory Synchronization Accounts directory role.
  3. The Local Database (LocalDB or SQL Server): Houses the synchronization engine configuration and stores symmetric encryption keys protected by Windows DPAPI and local LSA secrets.

Why It Matters in DFIR

Section titled “Why It Matters in DFIR”

Triage of the Entra Connect server is critical during hybrid intrusions:

  • Trivial Extraction of MSOL_ Credentials: Using public research tooling (e.g., PowerShell AzureAD_Decrypt_MSOL.ps1 or the AADInternals module), any local administrator on the Entra Connect server can decrypt the plaintext password of the MSOL_XXXXX account directly from the local database.
  • Immediate DCSync Execution: Because the MSOL_ account possesses directory replication rights by design, an attacker possessing its password can execute a DCSync against any DC, dumping the enterprise krbtgt key and all domain accounts.
  • On-Premise to Cloud Pivoting: Leveraging the cloud synchronization identity or altering synchronized directory attributes (e.g., configuring Seamless SSO spoofing or modifying UserPrincipalName attributes), an attacker expands on-premise domain dominance into Microsoft 365 / Azure.

How It Works

Section titled “How It Works”

Hybrid Synchronization Bridge Architecture

Section titled “Hybrid Synchronization Bridge Architecture”
┌────────────────────────────────────────────────────────┐
│           MICROSOFT ENTRA CONNECT SERVER               │
├────────────────────────────────────────────────────────┤
│ Synchronization Engine (miiserver.exe)                 │
│ DPAPI / LSA Cryptographic Master Key                   │
│ ADSync SQL Database (Stores encrypted sync credentials)│
└───────────────────────┬────────────────────────────────┘
                        │
       ┌────────────────┴────────────────┐
       ▼                                 ▼
┌──────────────────────────────┐  ┌──────────────────────────────┐
│  On-Premise Active Directory │  │   Microsoft Entra ID Cloud   │
├──────────────────────────────┤  ├──────────────────────────────┤
│ Account: MSOL_XXXXXXXXXXXX   │  │ Account: Sync_XXXXX_XXXXX    │
│ Rights: Replication-Get-All  │  │ Role: Directory Sync        │
│         (Enables DCSync!)    │  │       Accounts               │
└──────────────────────────────┘  └──────────────────────────────┘
  1. DPAPI Key Decryption: The ADSync database encrypts the MSOL_ account password using an encryption key stored in the machine’s local LSA secret store. An attacker with local administrative privileges invokes DPAPI to unprotect the key, subsequently extracting the cleartext MSOL_ password.
  2. Malicious Password Writeback: If Password Writeback is enabled for Self-Service Password Reset (SSPR), an attacker compromising an identity in the cloud can push password changes downward into the on-premise Active Directory.

What Is Possible

Section titled “What Is Possible”
  • Extracting MSOL_ Credentials in Seconds: Any member of the local Administrators or ADSyncAdmins group can extract cleartext credentials without generating DC alerts.
  • Impersonating Cloud Users via PHS Manipulation: An adversary controlling the sync engine can inject synthetic password hashes into Entra ID, hijacking cloud sessions of synchronized users.
  • Bypassing Cloud MFA: Cloud synchronization service accounts (Sync_) are frequently excluded from Conditional Access and multi-factor authentication policies to maintain unattended service continuity.

What Is Not Possible

Section titled “What Is Not Possible”
  • Decrypting the ADSync Database Remotely Without Host Access: Encryption keys are bound to local DPAPI and LSA secrets; the attacker must establish code execution on the Entra Connect server itself.
  • Modifying Pure Cloud-Native Accounts from On-Premise: Accounts authored directly in Entra ID (where Source of Authority: Cloud) cannot be modified by the on-premise synchronization engine.
  • Masking the DCSync Telemetry Generated by the MSOL Account: While MSOL_ is a legitimate account, its replication queries generate Event ID 4662 on the target DC.

Common DFIR Confusions

Section titled “Common DFIR Confusions”
Frequent ConfusionVerifiable Forensic Reality
”The Entra Connect server is merely a Tier 1 application server.”Critical architectural error. Entra Connect holds AD replication rights and cloud tenant control: it is an absolute Tier 0 / Control Plane asset.
”Resetting the MSOL account password does not disrupt synchronization.”False. Resetting MSOL_ in Active Directory without updating the Entra Connect configuration wizard halts synchronization immediately.
”DCSync alerts can safely whitelist the MSOL account.”Whitelisting the account name is a severe mistake. If the source IP of the DCSync event differs from the authorized Entra Connect server IP, MSOL_ credentials were stolen.

Concrete Forensic Example

Section titled “Concrete Forensic Example”

During an investigation at a legal advisory firm:

  1. Threat actors compromise SRV-AADSYNC by exploiting a vulnerable secondary monitoring service running on the host.
  2. The attackers run AADInternals to dump synchronization keys from the local database.
  3. They extract the cleartext password for MSOL_9d8f37a1e0b4.
  4. From an external pivot workstation 10.0.5.99, they invoke secretsdump.py targeting primary domain controller 10.0.1.10.
  5. DFIR Discovery: DC Event ID 4662 logs SubjectUserName: MSOL_9d8f37a1e0b4. However, corresponding Event 4624 records network source IP 10.0.5.99 rather than the authorized Entra Connect IP 10.0.2.15.
  6. Finding: Definite proof of credential harvesting from the Entra Connect bridge resulting in total local domain compromise.

Key Forensic Artefacts

Section titled “Key Forensic Artefacts”
  1. Entra Connect Host Logs:
    • Application Event Log: Events from source Directory Synchronization (Event IDs 100, 102, 107).
    • Process Telemetry: DLL injection or memory access targeting miiserver.exe or lsass.exe.
    • Database Queries: Direct queries accessing mms_management_agent in the ADSync database.
  2. Domain Controller Security Logs:
    • Event ID 4662: Replication queries executed by MSOL_XXXXX. Verify source network addresses in matching Event 4624 records.
  3. Microsoft Entra Cloud Audit Logs:
    • Activities initiated by the Sync_XXXXX service account updating sensitive user attributes or group memberships.

Investigation Methods

Section titled “Investigation Methods”
  1. Identify the Exact Local Synchronization Account: Run Get-ADUser -Filter 'Name -like "MSOL_*"' -Properties *.
  2. Correlate MSOL DCSync Queries with Authorized Source IPs: Audit Event IDs 4662 and 4624 across all DCs to verify that 100% of MSOL_ queries originate strictly from the Entra Connect server IP.
  3. Audit Local Administrators on the Entra Connect Server: Inspect membership of the local Administrators and ADSyncAdmins groups.

Investigative Tooling

Section titled “Investigative Tooling”
  • PowerShell AD Module:
    Terminal window
    # Query MSOL account metadata
    Get-ADUser -Filter 'Name -like "MSOL_*"' -Properties PasswordLastSet, whenCreated, Description
  • AADInternals (Lab / Audit):
    Terminal window
    Import-Module AADInternals
    Get-AADIntSyncCredentials

Key Takeaways

Section titled “Key Takeaways”
  • The Entra Connect server is an authoritative Tier 0 asset bridging on-premise and cloud infrastructure.
  • The local MSOL_XXXXX account holds DCSync directory replication rights by default.
  • Any local administrator on the Entra Connect host can decrypt MSOL_ credentials.
  • Any MSOL_ replication activity originating from an unapproved IP signifies a critical credential theft event.

References & Further Reading

Section titled “References & Further Reading”