Andy Robbins
As seen in:
Medium,
DZone,
Dark Reading,
The New Stack,
SC Media,
Security Boulevard,
My Tech Decisions
Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Andy Robbins
PingOne Attack Paths
TL;DR: You can use PingOneHound in conjunction with BloodHound Community Edition to discover, analyze, execute, and remediate identity-based attack paths in PingOne instances. Brief A few months ago the Ping Identity Corporation reached out to us and asked if we’d work to identify abuse primitives and bring our attack path management approach to their PingOne product. We of course agreed and Ping provided us with a free PingOne environment in which to perform our research efforts.
Browserless Entra Device Code Flow
Did you know that it is possible to perform every step in Entra's OAuth 2.0 Device Code flow - including the user authentication steps - without a browser?
Browserless Entra Device Code Flow
Did you know that it is possible to perform every step in Entra’s OAuth 2.0 Device Code flow — including the user authentication steps — without a browser?
The Most Dangerous Entra Role You’ve (Probably) Never Heard Of
Entra ID has a built-in role called “Partner Tier2 Support” that enables escalation to Global Admin, but this role is hidden from view in the Azure portal GUI.
Directory.ReadWrite.All Is Not As Powerful As You Might Think
Directory.ReadWrite.All is an MS Graph permission that is frequently cited as granting high amounts of privilege, even being equated to the Global Admin Entra ID role.
Directory.ReadWrite.All Is Not As Powerful As You Might Think
Directory.ReadWrite.All is an MS Graph permission that is frequently cited as granting high amounts of privilege, even being equated to the Global Admin Entra ID role. Why it matters Azure admins and security professionals may put undue focus on this permission at the expense of more impactful permissions Those more impactful permissions may go ignored, leaving potentially dangerous configurations in place Yes, but...
Microsoft Breach - What Happened? What Should Azure Admins Do? Original
On January 25, 2024, Microsoft published a blog post that detailed their recent breach at the hands of “Midnight Blizzard”. In this blog post, I will explain the attack path “Midnight Blizzard” used and what Azure admins and defenders should do to protect themselves from similar attacks. Step 0: The adversary used password guessing to gain initial access into a “test” tenant. Step 1: The adversary used this access to “compromise” an app registration in the test tenant (Figure 1).
Get Global Admin More Often
Discover new attack paths traversing Microsoft Graph and seven new Azure Resource Manager objects. Checking out BloodHound for the first time? Here are some handy resources: Shoutouts to the following folks for making material contributions to this release: Thank you to Hugo Vincent for his AzureHound contribution which adds app role assignment enumeration, enabling the MS Graph attack path feature.
How to Define Tier-Zero Assets in Active Directory Security
Organizations trying to improve the security of their Active Directory environments face a simple problem: Attackers have too many options. The average enterprise AD environment has thousands or tens of thousands of attack paths, which are chains of misconfigurations that allow an attacker with initial access to a low-privileged user to escalate privilege, move laterally to a high privilege user, and then take over the domain.
Financial credentials offer second-largest payoff in account takeover attacks
By Karen Hoffman,Andy Robbins,SC Staff In the Enterprise Security News: Blockchain security startups are still raising tons of money, but not in crypto, since it's now worthless. Ha! just kidding. Maybe. Am I? Anvilogic, AppViewX, Sotero, Resourcely, and Push Security all raise rounds JUICY RUMORS! Is Crowdstrike buying Orca? Is Akamai ...
How Attackers Move from Azure Active Directory to On-Prem AD
Andy Robbins Andy Robbins is a co-creator of BloodHound, the free and open source Active Directory attack path mapping and analysis tool. Andy has spoken at several conferences, including Black Hat USA, Black Hat Europe, and DEF CON, and has a background in professional red teaming and penetration testing.
Azure Privilege Escalation via Azure API Permissions Abuse
Microsoft’s Azure is a complicated system of principals, securable objects, and the various ways access is granted to those objects. Some privileged actions are tightly controlled by Azure AD roles, while other actions are controlled by roles and object ownership. Many objects in Azure are subject to distinct permissions systems, which can make effective access auditing very difficult. In this post, I will explain how one of those permissions systems can be abused to escalate to Global Admin.
Fixing Common AD Security Issues With BloodHound
Active Directory (AD) is Microsoft’s identity and access management software that controls which users have access to the systems and resources on a network. It’s a popular target for attackers because getting control of AD allows them to deploy malware, steal sensitive information or do other nasty things in a way that’s very difficult for defenders to detect or block.
Why Microsoft’s product volatility creates security risk in Azure
Today’s columnist, Andy Robbins of SpecterOps, offers three tips to help security teams more effectively manage the frequent security changes in Microsoft Azure. (Stephen Brashear/Getty Images) Microsoft recently announced a host of updates at Ignite 2021, including changes to Azure Arc, Azure SQL, and Azure Synapse.
Why Active Directory Attack Paths are the Secret to Many Successful Ransomware Attacks
It’s no secret that most major enterprises across the globe use Microsoft Active Directory (AD) for identity and access management. This ubiquity is also one of the predominant reasons AD is such a popular and attractive target for adversaries. What remains a mystery to many enterprises, however, is how adversaries – including the malicious actors behind the Conti, REvil, and DarkSide attacks use Attack Paths in AD to deploy ransomware.
Active Directory control: How adversaries score even bigger goals via attack paths
Microsoft Active Directory and Azure Active Directory are directory services products used for identity and access management at most major enterprises all over the world. All Active Directory (AD) environments are vulnerable to a type of attack called identity attack paths. In these attacks (also called identity snowball attacks), the adversary first compromises a host using a phishing email or some other method.
The 3 Most Common Misconfigurations in Microsoft Active Directory (and How to Fix Them)
Microsoft Active Directory (AD) is one of, if not THE, most critical services used by organizations of all sizes. In fact, for roughly 90% of Global Fortune 1000 companies, AD is the primary method utilized for seamless authentication and authorization when connecting and managing individual endpoints inside corporate networks.
Why Choke-Point Analysis Is Essential in Active Directory Security
Attackers that want to steal data, deploy ransomware, or conduct espionage must go through a series of steps, from initial access through establishing persistence and lateral movement to eventually exfiltrating the data. Abusing identity attack paths in Microsoft Active Directory (AD) is a popular method for attackers to accomplish several of these steps, including achieving persistence, privilege escalation, defensive evasion, credential access, discovery, and lateral movement.
Introducing BloodHound Enterprise: Attack Path Management for Everyone
Five years ago, we released BloodHound on stage at DEFCON 24. Since then, BloodHound has helped reshape how penetration testers and red teamers execute engagements. We and many other folks always knew that while BloodHound was interesting on the offensive side, its underlying capabilities were actually far more compelling on the defensive side. Today we are proud to introduce BloodHound Enterprise.
BloodHound versus Ransomware: A Defender’s Guide
You don’t need me to tell you how dangerous and destructive ransomware is. It seems like every week there is a new headline, with the same story: an organization was hit by ransomware, disrupting their operations, and causing plenty of monetary and personal loss through downtime, damage to the company brand, and individuals losing their jobs. It’s also no secret that more and more ransomware groups are using the free and open source version of BloodHound as part of their lateral movement suite.
Introducing BloodHound 4.0: The Azure Update
We released BloodHound in 2016. Since then, BloodHound has been used by attackers and defenders alike to identify and analyze attack paths in on-prem Active Directory environments. Now, I am very proud to announce the release of BloodHound 4.0: The Azure Update. This release is authored by myself (Andy Robbins), Rohan Vazarkar, and Ryan Hausknecht, with special thanks to Will Schroeder and Lee Christensen.
Death from Above: Lateral Movement from Azure to On-Prem AD
I’ve been looking into Azure attack primitives over the past couple of months to gain a better understanding of how the system works, what privileges and permissions can be abused, what limitations may exist, and what attack paths present themselves in real environments.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Andy
Contact Andy, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack