AAD Joined Machines - The New Lateral Movement

Explore new research on authentication mechanisms for Azure AD joined machines in this 36-minute Black Hat conference talk. Delve into the foundation of a new network protocol, learn about Pass-The-Certificate attacks, and discover an open-source solution for hunting potential threats. Gain insights into technical aspects such as cables, PKU, networks, messages, authentication, and VerifyNegoX. Presented by Mor Rubin, this talk offers valuable knowledge for cybersecurity professionals and IT administrators working with Azure AD environments.

Introduction
Technical Background
Cables
PKU
Networks
Messages
Authentication
Verify
NegoX
Demo
Preparation