Researchers from SecureWorks Counter Threat Unit Research Team discovered a flaw in Microsoft’s Azure Active Directory (Azure AD) that could give threat actors persistence and virtually undetectable access to a target’s Azure AD instance. The issue exists in the authentication method pass-through authentication (PTA), a method that allows organizations that cannot or do not want to sync password hashes to a cloud server. Using PTA requires administrators to deploy PTA agents to on-premises servers, typically a minimum of three (3) agents across an organization. During installation of these agents, a certificate signing request is sent to the Azure Active Directory instance, receiving a signed certificate as a response. This certificate is stored on the machine and can be extracted by attackers if they compromise the agent’s device. Once a threat actor obtains a certificate, they can create and deploy a custom PTA agent. Malicious agents can be used to harvest credentials, create backdoors, or conduct DoS attacks. While the PTA certificates expire after six (6) months, the certificates can be renewed indefinitely once the malicious agent is installed. While this flaw was reported to Microsoft in May 2022, Microsoft has stated this vulnerability does not pose any additional risk due to requiring access to the victim device. CTIX analysts recommend administrators consider other Azure AD authentication methods until Microsoft addresses this issue. It is also recommended to treat PTA agents as tier 0 servers, monitor for suspicious activity on PTA agent servers, and use multifactor authentication to prevent threat actors from using a malicious agent as a backdoor.