TR0.5 Hybrid Environment Mapping and Attack Surface

Figure TR0.5 — Northgate Engineering hybrid environment. 810 users across 3 environments connected by Entra Connect sync and SSH access paths. 6 documented hybrid attack paths enable cross-environment lateral movement.

The rapid environment snapshot

The triage responder needs answers to 5 questions within the first 2 minutes of any incident. These questions determine whether the alert is environment-scoped (single system) or cross-environment (hybrid attack chain):

Question 1: Does this identity exist in Entra ID?

1
2
3
4
5
6

// Check if the compromised account has a cloud identity
IdentityInfo
| where AccountName has "svc-dbadmin" or AccountUpn has "svc-dbadmin"
| project AccountName, AccountUpn, IsAccountEnabled, Department, 
    AccountObjectId, OnPremisesDistinguishedName
| take 5

If the account exists in Entra ID with an OnPremisesDistinguishedName: it is synchronised from on-prem AD via Entra Connect. A compromise of this account affects BOTH on-prem AD AND Entra ID. If the account exists only in Entra ID (no OnPremisesDistinguishedName): it is cloud-only.

Question 2: Is this device hybrid-joined?

1
2
3
4
5
6

// Check device registration status
DeviceInfo
| where DeviceName == "DESKTOP-NGE042"
| project DeviceName, JoinType, OSPlatform, AadDeviceId, 
    OnboardingStatus, MachineGroup
| take 1

JoinType values: AzureADJoined (cloud-only), HybridAzureADJoined (on-prem AD + Entra ID), AzureADRegistered (BYOD). Hybrid-joined devices have credentials in BOTH on-prem AD and Entra ID — a Primary Refresh Token (PRT) that can be replayed for cloud access without MFA (the Pass-the-PRT attack from TR2.2).

Question 3: Is this Linux server managed/monitored?

1
2
3
4

// Check Syslog ingestion for the server
Syslog
| where Computer == "SRV-NGE-BRS-DB01"
| summarize LastEvent = max(TimeGenerated), EventCount = count() by Computer

If the Syslog table has recent events: the server forwards logs to Sentinel. If the query returns empty: the server does NOT forward syslog — the triage relies entirely on local log analysis, and the cross-environment KQL queries from TR4.9 will not have Linux-side data.

Question 4: What connects to this system?

1
2
3
4
5
6
7

// Network connections TO the compromised system in the last 24 hours
DeviceNetworkEvents
| where RemoteIP == "10.1.2.50"  // Linux server IP
| summarize Connections = count(), 
    Devices = make_set(DeviceName, 20),
    Ports = make_set(RemotePort)
    by RemoteIP

This reveals all Windows devices that connected to the compromised Linux server — the potential lateral movement sources. Each device in the result set should be checked for compromise indicators.

Question 5: What data does this system access?

The business impact depends on what data the compromised system holds or connects to. A compromised web server that serves static content is LOW impact. A compromised database server holding customer PII is HIGH impact triggering GDPR Article 33 notification requirements. The environment map should document: server role → data classification → regulatory exposure.

Common hybrid attack paths at NE

The 6 NE attack chains demonstrate specific hybrid attack paths:

CHAIN-HARVEST: Cloud identity → M365 BEC. Path: AiTM phishing → session token theft → inbox rule creation → financial fraud. Environment boundary crossed: none (cloud-only attack), but DETECTION requires endpoint telemetry (the phishing email was delivered to the endpoint).

CHAIN-DRIFT: Cloud → Windows → Linux. Path: compromised identity → endpoint beacon deployment → LSASS credential dump → SSH lateral movement to Linux server. This is the cross-environment chain that TR4.9 fully traces.

CHAIN-PRIVILEGE: AD → Entra ID. Path: Kerberoasting → service account compromise → Entra Connect sync exploitation → cloud admin access. Environment boundary: on-prem AD to cloud via the Entra Connect sync mechanism.

CHAIN-ENDPOINT: Windows → AD. Path: phishing → beacon → DCSync → domain compromise. Classic Windows/AD attack path, contained within the on-prem environment.

CHAIN-MESH: Linux → container → host → AD. Path: web application vulnerability → container compromise → container escape (privileged mode) → host compromise → SSH to other servers → AD access via cached credentials. Multiple environment boundaries crossed.

CHAIN-FACTORY: Linux standalone. Path: SSH brute force → cryptominer deployment → persistence. Contained within the Linux environment, but the attacker may discover cached AD credentials on the Linux server (from Winbind/SSSD integration) and pivot to AD.

Building the environment map for your organisation

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

# Active Directory: domains, forests, trusts, DCs
Get-ADDomain | Select-Object DNSRoot, Forest, DomainControllersContainer
Get-ADTrust -Filter * | Select-Object Name, Direction, TrustType
Get-ADDomainController -Filter * | Select-Object Name, IPv4Address, OperatingSystem

# Entra ID: tenant, sync status, registered devices
Get-MgOrganization | Select-Object DisplayName, Id, VerifiedDomains
Get-MgServicePrincipal -Filter "displayName eq 'Azure AD Connect'" | Select-Object Id, AppId

# Linux: server inventory from Sentinel
Syslog | summarize LastSeen = max(TimeGenerated) by Computer | sort by LastSeen desc

# M365: licensed workloads
Get-MgSubscribedSku | Select-Object SkuPartNumber, ConsumedUnits

Document the results as the BASELINE environment map. During triage, any entity (user, device, server, application) not in the baseline warrants investigation — it may have been created by the attacker.

Troubleshooting

“I do not have access to all three environments.” This is common — the SOC analyst may have Sentinel access but not AD admin or Linux root. Document which queries you CAN run and which require escalation. The environment map should note access requirements per query. During triage, request access through the emergency access procedure rather than waiting for normal change management.

“The organisation does not have an environment map.” Build one NOW using the queries above. The first incident where you need the map and do not have it will cost hours of scope determination that could have been done in minutes. The environment map is a preparation-phase deliverable (NIST Preparation, SANS Preparation) — not a triage-phase creation.