Azure AD Kerberos Tickets: Pivoting to the Cloud

This report demonstrates a practical attack path in hybrid Azure AD environments where an attacker who extracts the AZUREADSSOACC$ machine account NTLM hash and on-prem SIDs can use AADInternals and ROADtools to request Kerberos tickets, obtain Azure AD tokens, impersonate service accounts (including AD Sync), elevate to global administrator, create users, and gain subscription-owner access—achieving full cloud compromise and persistence even if on-premises passwords are changed; the report recommends rotating the AZUREADSSOACC$ key and enforcing conditional access for service accounts.