Lateral Movement TA0008

Overview

Lateral Movement in Entra ID (formerly Azure AD) refers to techniques attackers employ to traverse and gain access to resources within an organization's identity and access management (IAM) environment. Adversaries often exploit compromised credentials, abused refresh or access tokens, or misconfigured role assignments to escalate privileges and expand their control. The goal is to navigate through interconnected services, groups, or identities to identify and access high-value targets. Attackers might abuse legitimate Entra ID tools such as PowerShell modules (e.g., AzureAD, MSOnline), Entra Graph API, or third-party management scripts to maintain stealth. Techniques include abusing service principals, leveraging excessive permissions in privileged roles, token impersonation, and exploiting conditional access gaps or trust relationships between tenants. Such activities may also target hybrid setups where on-premises Active Directory is synced to Entra ID, enabling deeper network infiltration.

For the scope of this section, we will primarily focus on compromising credentials.

1. Stealing Authentication Tokens

Technique: T1550 - Use Alternate Authentication Material Attackers search for access tokens or secrets left unprotected in memory, files, or logs. Attackers can also intercept them.

• T1550.001: Application Access Token

  Adversaries use tokens such as access, refresh, PRT tokens, or other bearer tokens to authenticate directly with services or applications. In Azure Entra ID, these tokens are commonly issued to apps and can be abused if compromised.