Detection of Unauthorized Access to Azure Cloud Credentials

This threat brief focuses on the exploitation of local Azure credential storage by infostealers, specifically the Vidar Stealer malware family. Adversaries target sensitive files stored on Windows endpoints - such as access tokens, profile data, and MSAL caches - to facilitate credential theft and cloud identity reconnaissance. By reading these files, attackers can exfiltrate valid session tokens, allowing them to bypass traditional authentication mechanisms and gain unauthorized access to cloud environments. Defenders must monitor for unauthorized read operations on these specific configuration files, as legitimate cloud tooling typically operates through well-defined, predictable process paths.

Impact

Successful exploitation allows attackers to gain persistence and unauthorized access to cloud-based resources associated with the compromised identity. This can lead to data exfiltration, lateral movement within cloud environments, and potential compromise of corporate infrastructure. The behavior is indicative of targeted infostealer campaigns that specifically prioritize high-value cloud configuration data.

Recommendation

• Enable Windows Security Event ID 4663 and configure System Access Control Lists (SACLs) on the following paths: %USERPROFILE%\.azure\accessTokens.json, %USERPROFILE%\.azure\azureProfile.json, %USERPROFILE%\.azure\msal_token_cache.json, %USERPROFILE%\.azure\TokenCache.dat, and %USERPROFILE%\Windows Azure Powershell\TokenCache.dat.
• Deploy the Sigma rule below to detect unauthorized read access to the aforementioned sensitive files.
• Establish a baseline for legitimate cloud-management processes (e.g., Azure CLI, VS Code) in your environment and maintain an allowlist to minimize false positives from administrative tools.
• Investigate any detected alerts originating from unknown or non-standard process paths, focusing on potential malicious activity such as credential staging or exfiltration.