A pure on-prem AD environment has one trust boundary. A pure cloud environment has one trust boundary. A hybrid environment has both, plus the sync mechanism connecting them, and attackers move across these boundaries in directions that monitoring often doesn't cover.

The core problem: on-prem AD compromise gives you cloud access (via AD Connect password hash sync, pass-through auth, or AD FS SAML forgery), and cloud compromise gives you on-prem access (via Azure AD Connect sync account, Intune device enrollment, or cloud-to-on-prem hybrid join). Most organizations monitor one environment well and the other poorly. Attackers exploit the transition.

• AD Connect sync account. The account that syncs password hashes from on-prem AD to Entra ID. Compromise of this account = ability to read all on-prem password hashes. Monitor for: unusual access to this service account, sign-ins from unexpected hosts, and permission changes.
• AD FS signing certificate. The private key that signs SAML tokens for federated authentication. Access to this key = Golden SAML = unlimited cloud access. Monitor for: certificate exports, AD FS server access by non-admin accounts, and SAML tokens with unusual claims or lifetimes.
• Seamless SSO computer account (AZUREADSSOACC). The Kerberos decryption key for this account enables Silver Ticket attacks against Azure AD. Monitor for: password changes on the AZUREADSSOACC$ account that don't correspond to scheduled rotation.
• Entra ID Global Administrator accounts. Cloud-side equivalent of Domain Admin. Should use phishing-resistant MFA, PIM (Privileged Identity Management) for just-in-time activation, and should NEVER be synced from on-prem AD (cloud-only accounts for cloud admin).
• OAuth application permissions. Service principals and app registrations with high-privilege scopes (Directory.ReadWrite.All, Mail.ReadWrite, RoleManagement.ReadWrite.Directory). These survive password resets and MFA changes.
• Conditional Access policy gaps. Policies that apply to users but not service principals, that cover browser access but not mobile apps, or that exclude "break glass" accounts that attackers discover and abuse.

1. 1. Audit AD Connect configuration and sync account Verify AD Connect health: is it syncing normally, has the configuration been modified, is password hash sync enabled (and should it be)? Check the sync service account (MSOL_*) for: password changes, unusual sign-in activity, and permission modifications. This account has DCSync rights by default. HOST: T1003.006 DCSync · Azure AD Connect Health
2. 2. Check for AD FS signing certificate access If you use AD FS: who has accessed the AD FS server recently? Check for: remote logons to the AD FS server, certificate export events, and PowerShell commands targeting AD FS configuration (Get-AdfsProperties, Export-PfxCertificate). If the signing certificate was compromised, rotate it immediately and revoke all issued tokens. HOST: Credential Access · AD FS audit logs · APT29 Golden SAML
3. 3. Audit on-prem privileged accounts for cloud access Domain Admins with synced Entra ID accounts have both on-prem and cloud admin rights. List all accounts with: on-prem DA/EA membership AND Entra ID Global Admin/Privileged Role assignments. These dual-privilege accounts are the highest-value targets because compromising one gives access to both environments. HOST: T1087.002 Domain Enumeration · Entra ID role assignments
4. 4. Search for cloud-to-on-prem lateral movement Can cloud access reach on-prem? Check for: Intune device management pushing scripts or configurations to domain-joined devices, Azure Arc connected machines that bridge cloud management to on-prem servers, and Entra ID joined devices with VPN access to the corporate network. Each is a reverse-pivot path. HOST: Lateral Movement · Intune script execution audit
5. 5. Review OAuth application consent grants and service principals The APT29 attack surface. Search for: recently created app registrations, apps with high-privilege API permissions (Directory.ReadWrite.All, Mail.ReadWrite), multi-tenant apps consented by non-admin users, and service principals with newly added credentials. One malicious OAuth app can provide persistent access that survives every credential reset. APT29 playbook · Entra ID: Enterprise Applications + App registrations
6. 6. Hunt for Kerberoasting and AS-REP roasting On-prem credential attacks that yield domain credentials usable for cloud access (via password hash sync). Kerberoasting: EID 4769 with RC4 etype targeting service accounts with SPNs. AS-REP roasting: accounts with "Do not require pre-authentication" enabled. Cracked passwords grant cloud access if the account syncs to Entra ID. HOST: T1558.003 Kerberoasting · T1003.006 DCSync
7. 7. Baseline authentication patterns across both surfaces Build a map: which accounts authenticate where (on-prem DC, Entra ID, both), from which sources (workstation, VPN, cloud app), at what times. The anomaly in hybrid environments is an account that normally authenticates only on-prem suddenly appearing in Entra ID sign-in logs (or vice versa). This cross-surface deviation is the detection signal for hybrid lateral movement. Security EID 4624 (on-prem) · Entra ID sign-in logs (cloud) · Correlation
8. 8. Check for PTA (Pass-Through Authentication) agent compromise If you use PTA instead of password hash sync: the PTA agent on your on-prem server validates cloud authentication requests in real-time. Compromise of the PTA agent host = ability to intercept and approve any cloud authentication. Verify PTA agent host integrity, check for unauthorized access, and ensure the host is hardened and monitored. HOST: Credential Access · PTA agent host Sysmon
9. 9. Verify Conditional Access coverage Conditional Access policies are only effective if they cover all authentication paths. Audit for: policies that exclude emergency/break-glass accounts (attackers discover and use these), policies that don't apply to service principals, gaps in MFA enforcement for legacy protocols, and named location exemptions that an attacker on VPN could abuse. Entra ID: Conditional Access audit · What-if analysis tool
10. 10. Test the on-prem-to-cloud escalation paths Proactively validate: can a Domain Admin create a Global Admin in Entra ID? Can the AD Connect sync account be used to extract password hashes? Can the AZUREADSSOACC Kerberos key be used to forge cloud authentication? These are the paths attackers use. If you can do it in a red team exercise, they can do it in an intrusion. BloodHound / AzureHound (maps hybrid escalation paths)

APT29 is the primary hybrid AD threat. The SolarWinds post-compromise escalation was entirely about abusing AD FS trust to move from on-prem to cloud (Golden SAML). Their 2024 Microsoft breach exploited a legacy test tenant. APT29's entire modern tradecraft is built around cloud identity abuse in hybrid environments.

APT28 targets Exchange and mailbox permissions in hybrid environments. Their campaigns modify mailbox folder permissions for persistent email access across both on-prem Exchange and Exchange Online.

Ransomware operators increasingly target hybrid AD for maximum impact: compromise on-prem DA, sync to cloud, disable cloud security controls, then deploy ransomware domain-wide with cloud-side backup destruction.