{"id":5134,"date":"2025-07-05T10:04:09","date_gmt":"2025-07-05T10:04:09","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2025\/07\/05\/researchers-uncover-new-technique-to-exploit-azure-arc-for-hybrid-escalation-in-enterprise-environment-and-maintain-persistence\/"},"modified":"2025-07-05T10:04:09","modified_gmt":"2025-07-05T10:04:09","slug":"researchers-uncover-new-technique-to-exploit-azure-arc-for-hybrid-escalation-in-enterprise-environment-and-maintain-persistence","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2025\/07\/05\/researchers-uncover-new-technique-to-exploit-azure-arc-for-hybrid-escalation-in-enterprise-environment-and-maintain-persistence\/","title":{"rendered":"Researchers Uncover New Technique to Exploit Azure Arc for Hybrid Escalation in Enterprise Environment and Maintain Persistence"},"content":{"rendered":"

Researchers Uncover New Technique to Exploit Azure Arc for Hybrid Escalation in Enterprise Environment and Maintain Persistence
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

Cybersecurity researchers have discovered a sophisticated attack technique that exploits Microsoft Azure Arc deployments to gain persistent access to enterprise environments.<\/p>\n

The research, conducted during recent red team operations, reveals how adversaries can leverage misconfigured Azure Arc<\/a> installations to escalate privileges from cloud environments to on-premises systems and maintain long-term persistence through legitimate Microsoft services.<\/p>\n

Azure Arc, Microsoft\u2019s hybrid cloud management platform, extends Azure\u2019s native management capabilities to on-premises systems, Kubernetes clusters, and other non-Azure resources.<\/p>\n

\n
\"\"
Arc management overview window (Source \u2013 IBM)<\/figcaption><\/figure>\n<\/div>\n

While designed to streamline hybrid infrastructure management, the service\u2019s deployment mechanisms and configuration processes have introduced new attack vectors that threat actors can exploit.<\/p>\n

The research demonstrates how attackers can identify Arc deployments in enterprise environments and abuse common misconfigurations to achieve code execution with system-level privileges.<\/p>\n

The attack techniques center around the exploitation of Service Principal credentials that are often hardcoded in deployment scripts or stored in accessible network<\/a> shares.<\/p>\n

\n
\"\"
Assigning roles as a part of Service Principal creation (Source \u2013 IBM)<\/figcaption><\/figure>\n<\/div>\n

These credentials, originally intended for automated Arc client registration, can be recovered by attackers who gain access to deployment infrastructure or policy configurations.<\/p>\n

Once obtained, these credentials can be weaponized to execute arbitrary code on Arc-managed systems through various Azure management interfaces.<\/p>\n

IBM analysts identified<\/a> multiple deployment vectors that introduce security vulnerabilities, including PowerShell scripts with embedded secrets, misconfigured System Center Configuration Manager (SCCM) deployments, and Group Policy Objects (GPOs) that store encrypted credentials using DPAPI-NG.<\/p>\n

\n
\"\"
Recovering SCCM script used to deploy Arc from SCCM site database with SQLRecon (Source \u2013 IBM)<\/figcaption><\/figure>\n<\/div>\n

The research team noted that these deployment methods, while following Microsoft\u2019s official guidance, often result in credential exposure due to overly permissive access controls and inadequate secret management practices.<\/p>\n

DPAPI-NG Exploitation and Credential Recovery<\/strong><\/h2>\n

The most significant finding involves the exploitation of DPAPI-NG encrypted secrets stored in Azure Arc deployment shares.<\/p>\n

When Arc is deployed via Group Policy, administrators create network shares containing deployment files, including an \u201cencryptedServicePrincipalSecret\u201d file protected by DPAPI-NG encryption.<\/p>\n

However, this encryption is configured to allow any member of the domain computers group to decrypt the secret, effectively making it accessible to any compromised system in the domain.<\/p>\n

The decryption process involves accessing the deployment share and using PowerShell<\/a> commands to retrieve the encrypted blob.<\/p>\n

Attackers can execute the following technique from any system with NT_AUTHORITYSYSTEM privileges:-<\/p>\n

$encryptedSecret = Get-Content (Join-Path $SourceFilesFullPath \"encryptedServicePrincipalSecret\")\n# DPAPI-NG blob configured to allow any member of domain computers group to decrypt<\/code><\/pre>\n
This credential recovery method provides attackers with Service Principal access that can be immediately weaponized for code execution on Arc-managed systems.<\/p>\n
The research demonstrates that these recovered credentials often possess elevated privileges beyond their intended scope, including the \u201cAzure Connected Machine Resource Administrator\u201d role, which grants comprehensive management capabilities over Arc deployments.<\/p>\n
Investigate live malware behavior, trace every step of an attack, and make faster, smarter security decisions ->\u00a0Try ANY.RUN now<\/strong><\/a><\/p>\n
The post Researchers Uncover New Technique to Exploit Azure Arc for Hybrid Escalation in Enterprise Environment and Maintain Persistence<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n
 \t

\n 
<\/BR>
\n    Tushar Subhra Dutta
\n \t

\n
<\/BR>
\nGo to cyber-security-news<\/a>
\n \t

\n 
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"
Researchers Uncover New Technique to Exploit Azure Arc for Hybrid Escalation in Enterprise Environment and Maintain Persistence Cybersecurity researchers have discovered a sophisticated attack technique that exploits Microsoft Azure Arc deployments to gain persistent access to enterprise environments. The research, conducted during recent red team operations, reveals how adversaries can leverage misconfigured Azure Arc installations […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[129,63,649],"tags":[130],"class_list":["post-5134","post","type-post","status-publish","format-standard","hentry","category-cyber-security","category-cyber-security-news","category-threats","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/5134"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=5134"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/5134\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=5134"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=5134"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=5134"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}