The most dangerous intrusions we respond to in 2026 don't live in a single environment. They start with a compromised identity, move through an endpoint, pivot into cloud infrastructure, and land on the data — with each hop crossing a different telemetry boundary owned by a different tool, a different team, and a different alert queue. Unit 42's recent analysis of the cross-environment pivot, published alongside their Managed XSIAM offering, puts a name to what IR teams have been seeing for years: attackers deliberately exploit the seams between our detection domains.
The problem isn't a lack of alerts. Most mature SOCs are drowning in them. The problem is that an EDR sees a suspicious process, an identity platform sees an anomalous sign-in, and a cloud security tool sees unusual API activity — and no one stitches those three weak signals into the single high-fidelity incident they actually represent. By the time an analyst manually correlates across consoles, the attacker has already escalated privileges and established persistence in the next environment. This post breaks down how cross-environment pivots work, why traditional SOC architectures fail against them, and what detection engineering looks like when you assume the attacker will cross boundaries.
Technical Analysis: Anatomy of a Cross-Environment Pivot
What "Cross-Environment" Actually Means
A cross-environment attack chain traverses at least two — usually three or more — distinct control planes:
- Identity layer: Active Directory, Entra ID, Okta — compromised via phishing, credential stuffing, MFA fatigue, or token theft
- Endpoint layer: Workstations and servers — compromised via initial access brokers, malicious payloads, or living-off-the-land techniques
- Cloud layer: AWS, Azure, GCP control planes and workloads — accessed via stolen credentials, over-privileged service principals, or sync-layer abuse
- SaaS layer: Email, file storage, and business apps — targeted for data staging and exfiltration
The Classic Attack Path
Unit 42's research describes a pattern we've validated across dozens of our own IR engagements:
- Identity compromise first. The attacker phishes credentials or purchases them from an access broker. The initial sign-in often looks benign to identity analytics because it comes from a residential proxy or a geolocation consistent with the victim's travel.
- Conditional access and MFA gap exploitation. Legacy authentication protocols (IMAP, SMTP AUTH) and service accounts excluded from MFA policies provide the foothold.
- Endpoint pivot via cloud management tooling. Rather than dropping malware immediately, the attacker abuses legitimate remote management — RMM tools, Azure Run Commands, AWS Systems Manager (
ssm-agent), or Intune scripts — to execute on endpoints. This generates almost no traditional malware telemetry. - On-prem to cloud escalation. From a compromised endpoint, the attacker harvests tokens from browser caches, credential managers, or memory (targeting LSASS), then replaying those tokens against cloud APIs from attacker-controlled infrastructure — defeating IP-based conditional access.
- Sync-layer abuse. Compromise of an Entra Connect / AD Connect server or an over-privileged sync account allows the attacker to move bidirectionally: on-prem admin to cloud global admin, or the reverse.
- Data access and exfiltration. The final hop targets object storage, databases, or SaaS repositories — often through legitimate application access rather than network-level exfiltration, rendering DLP and egress filtering partially blind.
Why Traditional SOC Architectures Fail
The failure mode is structural, not a staffing problem:
- Telemetry silos. EDR, IdP logs, cloud audit trails (CloudTrail, Azure Activity Log, GCP Audit Logs), and SaaS logs land in different systems with different schemas and different retention windows.
- Alert-centric triage. Each individual signal — an impossible-travel sign-in, a rare process execution, an unusual API call — is a medium-severity alert at best. Analysts close them in isolation. The attack is only visible in aggregate.
- Identity is the gap. Most SOCs still treat identity alerts as IT problems ("user locked out") rather than security problems ("session token replayed from new ASN").
- Timeline reconstruction is manual. During a pivot, an attacker can traverse from identity compromise to cloud data access in under 30 minutes. Manual cross-console correlation takes hours.
This is the operational premise behind extended detection platforms like XSIAM and the managed services built on them: normalizing telemetry across domains so that the attack path — not the individual alert — becomes the unit of analysis. Whether you adopt that vendor stack or build the correlation yourself in a SIEM, the defensive principle is the same and non-negotiable.
Exploitation Status
This is not a theoretical threat. Cross-environment intrusion paths are the dominant pattern in Unit 42's, Microsoft's, and CrowdStrike's recent IR reporting, and identity-based initial access has overtaken vulnerability exploitation as the leading entry vector in most 2025–2026 incident data. The techniques below reflect actively observed adversary behavior, not hypothetical scenarios.
Detection & Response
The detections below target the highest-signal pivot behaviors: token/session theft, sync-account abuse, cloud-to-endpoint command execution, and cross-domain sign-in anomalies. Each is designed to fire on the correlation of behaviors, which is where cross-environment detection earns its keep.
Sigma Rules
---
title: LSASS Memory Access by Non-System Process - Token and Credential Theft
description: Detects processes accessing LSASS memory, a key step in harvesting credentials and session tokens that enable cross-environment pivots from endpoint to cloud.
references:
- https://unit42.paloaltonetworks.com/soc-cross-environment-pivot/
- https://attack.mitre.org/techniques/T1003/001/
author: Security Arsenal
date: 2026/02/10
status: experimental
logsource:
category: process_access
product: windows
detection:
selection:
TargetImage|endswith: '\lsass.exe'
GrantedAccess|contains:
- '0x1010'
- '0x1410'
- '0x1438'
- '0x143a'
- '0x1FFFFF'
filter_legitimate:
SourceImage|endswith:
- '\MsMpEng.exe'
- '\svchost.exe'
- '\wininit.exe'
- '\csrss.exe'
SourceImage|startswith:
- 'C:\Program Files\Microsoft Defender'
- 'C:\ProgramData\Microsoft\Windows Defender'
condition: selection and not filter_legitimate
falsepositives:
- EDR and backup agents accessing LSASS - tune SourceImage exclusions to your stack
level: high
---
title: Cloud Management Tool Execution of Commands on Endpoints
description: Detects abuse of legitimate cloud management agents (AWS SSM, Azure Run Command) and RMM tooling to execute commands on endpoints - a common malware-free pivot technique in cross-environment intrusions.
references:
- https://unit42.paloaltonetworks.com/soc-cross-environment-pivot/
- https://attack.mitre.org/techniques/T1059/
- https://attack.mitre.org/techniques/T1102/
author: Security Arsenal
date: 2026/02/10
status: experimental
logsource:
category: process_creation
product: windows
detection:
selection_parent_ssm:
ParentImage|endswith:
- '\AmazonSSMAgent.exe'
- '\ssm-document-worker.exe'
- '\ssm-session-worker.exe'
selection_parent_azure:
ParentImage|endswith:
- '\WindowsAzureGuestAgent.exe'
- '\WaAppAgent.exe'
- '\GuestAgent.exe'
selection_child:
Image|endswith:
- '\powershell.exe'
- '\pwsh.exe'
- '\cmd.exe'
- '\wmic.exe'
- '\rundll32.exe'
- '\regsvr32.exe'
- '\curl.exe'
- '\bitsadmin.exe'
- '\certutil.exe'
condition: (selection_parent_ssm or selection_parent_azure) and selection_child
falsepositives:
- Legitimate administrative scripts pushed via SSM Run Command or Azure Run Command - baseline expected document/command names and alert on deviations
level: high
---
title: Entra Connect or AD Sync Account Interactive Logon
description: Detects interactive or network logon by directory synchronization service accounts. Sync accounts (MSOL_, AAD_, On-Premises Directory Synchronization) should never authenticate interactively; their compromise enables bidirectional on-prem/cloud pivots.
references:
- https://unit42.paloaltonetworks.com/soc-cross-environment-pivot/
- https://attack.mitre.org/techniques/T1078/
- https://attack.mitre.org/techniques/T1550/
author: Security Arsenal
date: 2026/02/10
status: experimental
logsource:
category: authentication
product: windows
detection:
selection_user:
User|startswith:
- 'MSOL_'
- 'AAD_'
- 'ADSync'
- 'DirSync'
selection_logon:
LogonType:
- 2
- 10
- 11
condition: selection_user and selection_logon
falsepositives:
- Rare troubleshooting by identity engineers - validate and document any legitimate interactive use, then suppress per account and host
level: critical
KQL — Microsoft Sentinel / Defender
The hunt below correlates identity-layer anomalies with endpoint and cloud control-plane activity in a single query — the exact cross-domain stitching that defeats siloed triage. It assumes Entra ID sign-in logs, Defender XDR tables, and Azure Activity Logs are ingested into the same workspace.
// Cross-environment pivot hunt: correlate suspicious sign-ins with
// privileged cloud operations and endpoint LOLBin execution for the same identity
let lookback = 7d;
let suspicious_signins =
SigninLogs
| where TimeGenerated > ago(lookback)
| where ResultType == 0
| where RiskLevelDuringSignIn in ("high", "medium")
or RiskEventTypes_V2 has_any ("anonymizedIPAddress", "unfamiliarFeatures", "tokenIssuerAnomaly")
| summarize FirstSignIn=min(TimeGenerated), Locations=make_set(Location),
IPs=make_set(IPAddress), Apps=make_set(AppDisplayName)
by UserPrincipalName;
let cloud_privileged_ops =
AzureActivity
| where TimeGenerated > ago(lookback)
| where OperationNameValue has_any (
"MICROSOFT.AUTHORIZATION/ROLEASSIGNMENTS/WRITE",
"MICROSOFT.COMPUTE/VIRTUALMACHINES/RUNCOMMAND/ACTION",
"MICROSOFT.STORAGE/STORAGEACCOUNTS/LISTKEYS/ACTION",
"MICROSOFT.KEYVAULT/VAULTS/SECRETS/READ")
| summarize CloudOps=make_set(OperationNameValue), FirstOp=min(TimeGenerated)
by Caller;
let endpoint_lolbins =
DeviceProcessEvents
| where TimeGenerated > ago(lookback)
| where FileName in~ ("powershell.exe", "wmic.exe", "rundll32.exe", "bitsadmin.exe", "certutil.exe")
| where InitiatingProcessFileName has_any ("AmazonSSMAgent", "ssm-document-worker", "WindowsAzureGuestAgent")
or ProcessCommandLine has_any ("Invoke-Mimikatz", "-enc ", "FromBase64String", "sekurlsa")
| summarize EndpointCmds=make_set(ProcessCommandLine, 5), FirstExec=min(TimeGenerated)
by AccountName, DeviceName;
suspicious_signins
| join kind=inner (cloud_privileged_ops) on $left.UserPrincipalName == $right.Caller
| join kind=leftouter (endpoint_lolbins) on $left.UserPrincipalName == $right.AccountName
| project UserPrincipalName, FirstSignIn, IPs, Locations, CloudOps, FirstOp, DeviceName, EndpointCmds
| sort by FirstSignIn asc
Velociraptor VQL
Use this artifact across your fleet to surface the credential/token theft staging that precedes a cross-environment pivot — LSASS access artifacts, dumped credential files, and cloud CLI/token caches accessed outside expected tooling.
-- Hunt: credential theft staging and cloud token cache access (cross-environment pivot precursors)
SELECT Pid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(lsass|procdump|comsvcs.*MiniDump|sekurlsa|token::|Invoke-Mimikatz)'
OR Exe =~ '(?i)(rundll32|regsvr32|wmic|procdump)\.exe$'
-- Companion file artifact: hunt for LSASS dumps and accessed cloud credential caches
-- SELECT FullPath, Size, Mtime FROM glob(globs=[
-- 'C:/Users/*/AppData/Local/*.dmp',
-- 'C:/Windows/Temp/*.dmp',
-- 'C:/Users/*/.aws/credentials',
-- 'C:/Users/*/.azure/accessTokens.json',
-- 'C:/Users/*/AppData/Local/.IdentityService/AccountStore.json'
-- ]) WHERE Mtime > now() - 604800
Hardening & Verification Script
# Cross-Environment Pivot Hardening — Identity and Endpoint Controls
# Run as a tier-0 admin. Review output before enforcing any change.
# 1) Verify MFA coverage on directory sync and break-glass accounts
Connect-MgGraph -Scopes "Policy.Read.All","User.Read.All" -NoWelcome
$syncAccounts = Get-MgUser -Filter "startswith(userPrincipalName,'Sync_') or startswith(userPrincipalName,'ADSync')" -All
foreach ($acct in $syncAccounts) {
$methods = Get-MgUserAuthenticationMethod -UserId $acct.Id
Write-Host "$($acct.UserPrincipalName): $($methods.Count) auth methods registered"
if ($methods.Count -gt 0) {
Write-Warning "Sync account has interactive auth methods — investigate and disable interactive sign-in."
}
}
# 2) Disable legacy authentication protocols (common MFA bypass path)
# Verify no legacy auth sign-ins in the last 14 days first, then block via Conditional Access.
# Portal path: Entra ID > Security > Conditional Access > Block legacy authentication
# 3) Restrict who can run Azure VM Run Commands / SSM documents to a named admin group
Get-AzRoleAssignment | Where-Object {
$_.RoleDefinitionName -match 'Virtual Machine Contributor|Contributor|Owner'
} | Select-Object DisplayName, RoleDefinitionName, Scope | Format-Table -AutoSize
# Action: replace broad Contributor assignments with scoped, PIM-eligible roles.
# 4) Enable LSASS protection (Credential Guard / PPL) to disrupt token theft
$lsaPath = 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa'
$runAsPPL = (Get-ItemProperty -Path $lsaPath -Name RunAsPPL -ErrorAction SilentlyContinue).RunAsPPL
if ($runAsPPL -ne 1) {
Set-ItemProperty -Path $lsaPath -Name RunAsPPL -Value 1 -Type DWord
Write-Host "LSASS RunAsPPL enabled — reboot required to take effect."
} else {
Write-Host "LSASS RunAsPPL already enabled."
}
# 5) Audit cloud credential caches for unexpected modification (token theft indicator)
Get-ChildItem "$env:USERPROFILE\.aws\credentials",
"$env:USERPROFILE\.azure\accessTokens.json" -ErrorAction SilentlyContinue |
Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-3) } |
Select-Object FullName, LastWriteTime
Remediation
Cross-environment defense is an architecture problem, not a patch. Prioritize in this order:
- Close the identity seams first. Enforce phishing-resistant MFA (FIDO2/passkeys) on all admin and sync accounts. Block legacy authentication protocols tenant-wide. Disable interactive sign-in on all directory synchronization service accounts and alert on any attempt.
- Protect the sync layer. Treat Entra Connect / AD Connect servers as tier-0 assets. Dedicated admin workstations, no internet browsing, full EDR coverage, and the Sigma rule above monitoring sync-account logons.
- Constrain cloud-to-endpoint execution paths. Scope SSM Send-Command and Azure Run Command permissions to named, PIM-eligible admin groups. Log every invocation to your SIEM and baseline the expected document/command inventory.
- Harden endpoints against credential theft. Enable LSASS PPL, Credential Guard, and disable WDigest. Rotate credentials for any account whose endpoint was touched in an incident — assume token theft.
- Unify the telemetry. Whether via XSIAM, Sentinel, or another platform, ingest identity sign-in logs, cloud audit trails (CloudTrail / Azure Activity / GCP Audit), endpoint process telemetry, and SaaS logs into one analytics layer with a common identity key. Set retention high enough (12+ months) to support retro hunts.
- Detect on paths, not alerts. Build or adopt correlation rules that chain identity anomaly → privileged cloud operation → endpoint execution for the same principal within a time window. That is the detection pattern this threat class demands.
- Rehearse the pivot. Run a tabletop or purple-team exercise that simulates the exact chain above — phished identity → cloud pivot → endpoint execution → data access — and measure your mean time to correlate. If it's over an hour, your SOC architecture, not your analysts, is the bottleneck.
Related Resources
Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.