corpus.blog
41554 blogs · 4,417,066 posts Claim your blog
Record · corpus.blog/posts/01a08796-2744-70c0-bfdf-30f35728b3de

Persisting Unseen: Defending against Entra ID persistence

kknowl.es · published 4 June 2025

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at kknowl.es Wayback capture
0blogs citing
First cited
—
Most recent
—
Rank this month
not ranked
Links from this post
71
Words captured
2,251

Cited by

No blog we hold has cited this post yet.

Links from this post

Link
Host
https://www.rsaconference.com/library/virtual%20seminar/hds19-cloud-security
rsaconference.com
https://kknowl.es/assets/pdf/2025_RSAC-Cloud-Seminar_Entra-ID-Persistence.pdf
kknowl.es
https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
learn.microsoft.com
https://www.invictus-ir.com/news/cloud-incident-readiness-key-logs-for-cloud-incidents
invictus-ir.com
https://kknowl.es/assets/img/defending-persistence/securing-roles.png
kknowl.es
https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/concept-understand-roles
learn.microsoft.com
https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference
learn.microsoft.com
https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/privileged-roles-permissions
learn.microsoft.com
https://www.hub.trimarcsecurity.com/post/demystifying-privileged-identity-management-part-1
hub.trimarcsecurity.com
https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/administrative-units
learn.microsoft.com
https://learn.microsoft.com/en-us/azure/role-based-access-control/elevate-access-global-admin?tabs=azure-portal%2Centra-audit-logs
learn.microsoft.com
https://specterops.io/blog/2024/02/16/the-most-dangerous-entra-role-youve-probably-never-heard-of/
specterops.io
https://securitylabs.datadoghq.com/articles/abusing-entra-id-administrative-units/
securitylabs.datadoghq.com
Reporting on Entra ID directory role assignments (including PIM) Read at the source ↗
michev.info
https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/view-assignments
learn.microsoft.com
https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/
learn.microsoft.com
https://kknowl.es/assets/img/defending-persistence/securing-apps.png
kknowl.es
https://www.youtube.com/watch?v=WVNvoiA_ktw&t=1200s
youtube.com
https://learn.microsoft.com/en-us/entra/identity-platform/application-model
learn.microsoft.com
https://www.semperis.com/blog/unoauthorized-privilege-elevation-through-microsoft-applications/
semperis.com
OSINT Read at the source ↗
aadinternals.com
Azure AD privilege escalation - Taking over default application permissions as Application Admin Read at the source ↗
dirkjanm.io
https://msrc.microsoft.com/blog/2024/01/microsoft-actions-following-attack-by-nation-state-actor-midnight-blizzard/
msrc.microsoft.com
https://www.wiz.io/blog/midnight-blizzard-microsoft-breach-analysis-and-best-practices
wiz.io
https://msrc.microsoft.com/blog/2023/01/threat-actor-consent-phishing-campaign-abusing-the-verified-publisher-process/
msrc.microsoft.com
Script to review and remove service principal credentials Read at the source ↗
michev.info
https://learn.microsoft.com/en-us/entra/identity-platform/howto-configure-app-instance-property-locks
learn.microsoft.com
https://learn.microsoft.com/en-us/entra/identity-platform/security-best-practices-for-app-registration
learn.microsoft.com
How to block the creation of Client Secrets on Entra applications Read at the source ↗
ourcloudnetwork.com
https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/configure-user-consent?pivots=portal
learn.microsoft.com
https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/protect-against-consent-phishing
learn.microsoft.com
https://learn.microsoft.com/en-us/defender-cloud-apps/investigate-risky-oauth
learn.microsoft.com
https://kknowl.es/assets/img/defending-persistence/securing-auth.png
kknowl.es
https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-methods
learn.microsoft.com
https://learn.microsoft.com/en-us/entra/identity/conditional-access/overview
learn.microsoft.com
https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-block-authentication-flows
learn.microsoft.com
https://www.microsoft.com/en-us/security/blog/2025/02/13/storm-2372-conducts-device-code-phishing-campaign/
microsoft.com
https://www.microsoft.com/en-us/security/blog/2023/10/25/octo-tempest-crosses-boundaries-to-facilitate-extortion-encryption-and-destruction/
microsoft.com
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a
cisa.gov
https://posts.specterops.io/id-tap-that-pass-8f79fff839ac
posts.specterops.io
https://www.secura.com/services/information-technology/vapt/what-can-be-pentested/cloud-pentesting/abusing-fido2-passkeys
secura.com
https://learn.microsoft.com/en-us/entra/id-governance/conditional-access-exclusion
learn.microsoft.com
https://learn.microsoft.com/en-us/graph/permissions-overview?tabs=http
learn.microsoft.com
https://learn.microsoft.com/en-us/graph/permissions-reference
learn.microsoft.com
https://graphpermissions.merill.net/permission/
graphpermissions.merill.net
https://github.com/emiliensocchi/azure-tiering/tree/main/Microsoft%20Graph%20application%20permissions
github.com
https://entra.news/
entra.news
https://www.secureworks.com/research?q=azure
secureworks.com
https://www.thelazyadministrator.com/
thelazyadministrator.com
https://xybytes.com/
xybytes.com
https://dirkjanm.io/ Read at the source ↗
dirkjanm.io
https://aadinternals.com/
aadinternals.com
https://www.emiliensocchi.io/
emiliensocchi.io
https://jeffreyappel.nl/
jeffreyappel.nl
https://www.inversecos.com/
inversecos.com
https://goodworkaround.com/
goodworkaround.com
https://blog.merill.net/
blog.merill.net
https://nathanmcnulty.com/
nathanmcnulty.com
https://call4cloud.nl/
call4cloud.nl
https://sapirxfed.com/blog-posts/
sapirxfed.com
https://www.cloud-architekt.net/blog/
cloud-architekt.net
https://www.michev.info/
michev.info
https://www.binarysecurity.no/posts/
binarysecurity.no
https://securitylabs.datadoghq.com/
securitylabs.datadoghq.com
https://falconforce.nl/blogs/
falconforce.nl
https://www.invictus-ir.com/news
invictus-ir.com
https://www.netspi.com/blog/technical-blog/
netspi.com
https://permiso.io/blog
permiso.io
https://specterops.io/blog/category/research/
specterops.io
https://trustoncloud.com/blog/
trustoncloud.com
https://www.wiz.io/blog/tag/research
wiz.io