# Skeleton Keys (PTA Abuse)

## What Is Skeleton Keys (PTA Abuse)

Allows TA to backdoor or MiTM the pass through-authentication mechanism used for authentication.

* When a user logs into Azure AD, it is redirected to the PTA agent which checks with the DC if the password is correct&#x20;
* When password is correct, the PTA agent responds to Azure AD and grants access.

## Attack

### **Adam Chester Blog:**

{% embed url="<https://blog.xpnsec.com/azuread-connect-for-redteam/>" %}

Attack flow

1. Inject a DLL into the Azure AD Sync process (AzureADConnectAuthenticationAgentService.exe).
2. From within the injected DLL, patch the LogonUserW function to jump to our hook.
3. When our hook is invoked, parse and store the credentials.
4. Forward the authentication request on to LogonUserExW.
5. Return the result.

### **PTASpy:**

{% embed url="<https://github.com/Gerenios/public/blob/master/PTASpy.cpp>" %}

If Hybrid Identity Administrator account is compromised, the TA can download and install AD connect agent on the attacker machine and harvest more credentials.

## Detect

### What logs are available?

## Mitigate
