BP-045 Stealthy Persistence via Directory Sync Manipulation
What This Breach Pattern Is
This breach pattern occurs when adversaries compromise identity synchronization infrastructure—systems that serve as the automated backbone of enterprise identity management. Attackers target Entra ID Connect, SCIM provisioning agents, HR-to-IDP sync engines, custom lifecycle automation scripts, and third-party SCIM 2.0 connectors to establish persistence.
These synchronization systems manage critical identity lifecycle operations: user provisioning, attribute mapping, group membership assignment, role distribution, and activation/deactivation workflows. When attackers gain control of the sync engine or manipulate mapping rules, they create persistent backdoor identities that are automatically recreated, continuously reactivated, re-privileged on every sync cycle, hidden from administrative dashboards, and embedded directly into HR or source-of-truth systems. Provisioning drift represents one of the most challenging identity persistence mechanisms to detect and remediate.
Attacker Objectives
Self-Healing Accounts
Create hidden accounts that automatically reappear after deletion attempts, ensuring persistent access
Privilege Maintenance
Maintain privileged group membership through automated sync cycles, bypassing manual removal
Attribute Injection
Inject malicious attributes including admin flags that propagate across connected systems
HR Bypass
Circumvent HR-driven deactivation processes by manipulating source system records
This technique enables self-healing persistence that propagates across SaaS applications via SCIM, creating ghost identities mapped to fabricated HR entries. The result is long-term, self-repairing control of the identity fabric—nearly impossible to eradicate without addressing the root synchronization mechanism.
Compromise sync engine credentials or authentication mechanisms
2
Stage 5: Privilege Escalation
Manipulate provisioning rules to inject administrative privileges
3
Stage 7: Identity-Based Lateral Movement
Leverage synchronized identities to move across connected systems
4
Stage 8: Persistence via Identity
Establish self-healing backdoor accounts that continuously reappear
Provisioning drift creates an identity persistence mechanism that reappears continuously through automated synchronization, effectively evading traditional remediation approaches and requiring systemic changes to the provisioning architecture itself.