AzureADLateralMovement allows to build Lateral Movement graph for Azure Active Directory entities - Users, Computers, Groups and Roles. Using the Microsoft Graph API AzureADLateralMovement extracts interesting information and builds json files containing lateral movement graph data competable with Bloodhound 2.2.0
Some of the implemented features are :
- Extraction of Users, Computers, Groups and Roles.
- Creation of BloodHound objects
- Inject the object to CosmosDb Graph
Explanation: Terry Jeffords is a member of Device Administrators.
This group is admin on all the AAD joined machines including Desktop-RGR29LI
Where the user Amy Santiago has logged-in in the last 2 hours and probably still has a session.
This attack path can be exploited manually or by automated tools.
The MicrosoftGraphApi Helper is responsible for retriving the required data from Graph API
Responsible for creating json files that can dropped on BloodHound 2.2.0 to extend the organization covered entities
In case you prefer using the Azure CosmosDb service instead of the BloodHound client, this module will push the data retrived into a graph database service
- Download, compile and run
- Browse to http://localhost:44302
- Logon with AAD administrative account
- Click on "AzureActiveDirectoryLateralMovement" to retrive data
- Drag the json file into BloodHound 2.2.0
An example configuration as below :
<appSettings>
<add key="ida:AppID" value= "<Azure app id>" />
<add key="ida:AppPassword" value="<Azure app secret>" />
<add key="ida:RedirectUri" value="http://localhost:44302" />
<add key="ida:AppScopes"
value="User.Read Mail.Read MailboxSettings.ReadWrite User.Read.All Directory.Read.All AuditLog.Read.All" />
<add key="ida:OutputFolderLocation" value="C:\AzureAdLateralMovement\" />
<add key="ida:IsCosmosDbGraphEnabled" value="false" />
<add key="ida:EndpointUrl" value="https://<CosmosDbEndPoint>.documents.azure.com:443/" />
<add key="ida:AuthorizationKey" value="<CosmosDbEndPoint AuthorizationKey>" />
</appSettings>
Before start using this tool you need to create an Application on the Azure Portal. Go to Azure Active Directory -> App Registrations -> Register an application.
After creating the application, copy the Application ID and change it on AzureOauth.config.
The URL(external listener) that will be used for the application should be added as a Redirect URL. To add a redirect url, go the application and click Add a Redirect URL.
The Redirect URL should be the URL that will be used to host the application endpoint, in this case https://localhost:44302/
Make sure to check both the boxes as shown below :
The lateral movement graph allows investigate available attack paths truly available in the AAD environment. The graph is combined by Nodes of Users, Groups and Devices, where the edges are connecting them by the logic of �AdminTo�, �MemberOf� and �HasSession� This logic is explained in details by the original research document: https://github.com/BloodHoundAD/Bloodhound/wiki
In the on-premise environment BloodHound collects data using SMAR and SMB protocols to each machine in the domain, and LDAP to the on-premise AD.
In Azure AD environment, the relevant data regarding Azure AD device, users and logon sessions can be retrieved using Microsoft Graph API. Once the relevant data is gathered it is possible to build similar graph of connections for users, groups and Windows machines registered in the Azure Active Directory.
To retrive the data and build the graph data this project uses: Azure app Microsoft Graph API Hybrid AD+AAD domain environment synced using pass-through authentication BloodHound UI and entities objects
Devices - AAD joined Windows devices only and their owner's
Users - All AD or AAD users
Administrative roles and Groups - All memberships of roles and groups
Local Admin - The following are default local admins in AAD joined device - Global administrator role - Device administrator role - The owner of the machine
Sessions - All logins for Windows machines
Exploring graph queries on top of Azure Cosmos DB with Gremlin https://github.com/talmaor/GraphExplorer SharpHound - The C# Ingestor https://github.com/BloodHoundAD/BloodHound/wiki/Data-Collector Quickstart: Build a .NET Framework or Core application using the Azure Cosmos DB Gremlin API account https://docs.microsoft.com/en-us/azure/cosmos-db/create-graph-dotnet How to: Use the portal to create an Azure AD application and service principal that can access resources https://docs.microsoft.com/en-us/azure/active-directory/develop/howto-create-service-principal-portal