Back to Blog
How Red Teamers Hijack Primary Refresh Tokens to Pivot to Azure

How Red Teamers Hijack Primary Refresh Tokens to Pivot to Azure

The Cybersecurity and Infrastructure Security Agency (CISA) recently released an eye-opening report. The report emphasizes that even some of the most advanced red teamers (the ones government agencies look to for advice) rely on everyday techniques that have been in the public domain for years. In this post, we’ll break down what a PRT is, demonstrate how attackers extract and use it, and outline how you can protect your organization using the findings from the report.

The Cybersecurity and Infrastructure Security Agency (CISA) recently released an eye-opening report, "A Tale of Two SOCs". The results are striking. Not because they reveal groundbreaking zero-days, but because they emphasize that even some of the most advanced red teamers (the ones government agencies look to for advice) rely on everyday techniques that have been in the public domain for months, if not years.

While the report covers broad ground, it glosses over a highly effective, lesser-documented pivot technique: stealing an Azure application owner’s Primary Refresh Token (PRT) to compromise a highly privileged application and pivot from on-premises to elevated cloud access.

In this post, we’ll break down this attack vector, explain what a PRT is, demonstrate how attackers extract and use it, and outline how you can protect your organization using the findings from the report.

The Attack Chain: From On-Premises to Cloud Access

The technical route from an on-premises breach to full Azure compromise followed a distinct, four-step pattern:

  1. Target Identification: Identify the owner of an Azure application that possesses elevated permissions like Mail.ReadWrite.
  2. Lateral Movement: Move laterally to the owner's on-premises machine.
  3. PRT Extraction: Obtain access to the owner's Primary Refresh Token (PRT) stored on the device.
  4. Cloud Pivot: Use the stolen PRT to request access and refresh tokens for the targeted application's owner, enabling impersonation.

This attack path is highly dangerous but isn't new. The infamous SolarWinds supply chain attack, executed by the threat actors known as Nobelium, used similar techniques dating back as early as 2020. Microsoft also reported similar techniques in a detailed blog post on protecting against these vectors.

What is a Primary Refresh Token (PRT)?

A Primary Refresh Token (PRT) is a secure cryptographic artifact specifically issued to Microsoft first-party token brokers to enable Single Sign-On (SSO) across the applications used on those devices.

This is a lot of technical jargon to say: it is a special credential that Windows stores on Entra ID-joined devices to allow for SSO from on-prem to Azure resources.

For an attacker, the PRT is extremely high-value. When hacking Azure, extracting the PRT cookie can allow session impersonation without needing phishing or user credentials.

In other words, getting hold of the PRT allows for a wide level of access, provided that Single Sign-On (SSO) is active, which is a key prerequisite for this attack chain.

Step-by-Step: How the PRT is Hijacked and Passed

Let’s look at how this phase of the attack is executed once an attacker has moved laterally and compromised the application owner's machine.

The Lab Setup

To replicate this attack chain, the configuration mirrors a standard enterprise setup:

  • An Azure tenant with SSO enabled.
  • A Windows 11 endpoint joined to Microsoft Entra.
  • An active session of an application administrator (or owner) logged into the Windows 11 endpoint.

Step 1: Validating SSO and Entra Join Status

First, the attacker validates that SSO is active and that a PRT is in use by running the following command on the compromised device:

dsregcmd This command shows that the machine is joined to Azure and that a PRT is in use

.

Step 2: Extracting the PRT

Once PRT usage is confirmed, the attacker can leverage specialized post-exploitation tools to bypass security boundaries and extract the token. Two of the most straightforward and effective tools for this are:

1. BAADTokenBroker

First released at Black Hat Asia 2024 by SecureWorks, BAADTokenBroker is a post-exploitation PowerShell script designed to leverage device-stored keys (such as the Device Key and Transport Key) to authenticate directly to Microsoft Entra ID.

Running it requires only two commands in PowerShell:

Import-Module .\BAADTokenBroker.ps1 Request-PRTCookie

2. PRTextractor

PRTextractor is a Go-based tool for Windows designed to extract the PRT from devices joined to Microsoft Entra ID. Once compiled, running the executable on the target host retrieves the PRT directly.

Step 3: "Pass-the-PRT" and Pivoting into Azure

With the extracted PRT cookie in hand, the attacker can easily pivot to hacking Azure using standard web channels.

  1. Accessing the Portals: The attacker opens a standard browser and visits login.microsoftonline.com or portal.azure.com.
  2. Cookie Injection: They inject the stolen token into the browser under the cookie name: x-ms-RefreshTokenCredential
  1. Session Refresh: Upon refreshing the browser, access is immediately granted as the application owner.
  2. Elevating Privileges: Once authenticated as the application owner, the attacker can add a new secret to the service principal (the highly privileged application) and authenticate to Azure as the application itself. This allows them to claim the high privileges associated with that service principal, completing the pivot.

Defending Your Organization: Crucial Takeaways

To avoid falling victim to these pivot attacks, organizations must focus on addressing root cause misconfigurations. Implement these defensive recommendations immediately:

  1. Evaluate SSO Usage: Consider disabling Single Sign-On (SSO) as SSO is the main prerequisite for this attack.
  2. Audit Service Principals: Regularly review all privileged service principles (applications) in your Azure environment.
  3. Monitor Multi-Secret Service Principals: Review and alert on any service principles that have more than one secret assigned, as adding an unauthorized second secret is a common method for attackers to maintain access.
  4. Automate Posture Assessments: Utilizing tools like Astra can help you find these exact misconfigurations and identify vulnerabilities in your tenant with a single click.

Understanding the methods used by CISA red teamers and advanced threat actors is key to protecting cloud-joined infrastructure. By monitoring service principal credentials, auditing SSO usage, and leveraging security automation tools, you can ensure your organization remains resilient against these lateral pivot tactics.

How Can Astra Help

Astra customers can use the built in use cases to identify similar privileged principals and other misconfiguration with a click of a button.

Contact us for inquiries or a demo https://astrasec.io/#cta