https://feed.craftedsignal.io/products/azure-network-watcher/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 11 Jan 2024 12:00:00 +0000https://feed.craftedsignal.io/briefs/2024-01-11-azure-packet-capture/Thu, 11 Jan 2024 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-11-azure-packet-capture/Detection of Azure Network Watcher's Packet Capture feature being enabled, potentially indicating malicious network sniffing for credential access and discovery of sensitive data in unencrypted traffic.The Azure Network Watcher Packet Capture feature is designed for legitimate network traffic inspection and troubleshooting. However, malicious actors can abuse this feature to perform network sniffing and capture sensitive data, including credentials, from unencrypted internal traffic within Azure Virtual Networks (VNets). This can lead to unauthorized access to systems and data. The detection rule focuses on identifying instances where packet capture is initiated successfully, providing an opportunity to detect and respond to potential credential access attempts. The rule leverages Azure activity logs to monitor for specific packet capture operations, ensuring that suspicious activity is flagged for investigation. The scope of this threat is limited to Azure environments that utilize Network Watcher and have not implemented proper network segmentation or encryption.

Attack Chain

1. Initial Access: An attacker gains access to an Azure account with sufficient privileges to manage Network Watcher and initiate packet captures.
2. Discovery: The attacker uses the compromised account to explore the Azure environment, identifying target VNets and subnets containing potentially valuable data.
3. Packet Capture Configuration: The attacker configures the Network Watcher Packet Capture feature to capture traffic from the targeted VNet or subnet. This involves specifying the target VM or network interface and the duration of the capture.
4. Start Packet Capture: The attacker initiates the packet capture process, which begins recording network traffic based on the configured parameters. The MICROSOFT.NETWORK/*/STARTPACKETCAPTURE/ACTION operation is triggered in the Azure activity logs.
5. Data Acquisition: Network traffic, including unencrypted credentials or sensitive data, is captured and stored in a designated storage account.
6. Data Exfiltration (Potential): If the attacker has configured the packet capture to store data outside the secure environment, they may exfiltrate the captured data for further analysis or malicious use.
7. Credential Access: The attacker analyzes the captured network traffic to identify and extract credentials or other sensitive information.
8. Lateral Movement/Privilege Escalation: Using the acquired credentials, the attacker attempts to move laterally within the Azure environment, gaining access to additional systems and resources, or escalate privileges to gain higher-level control.

Impact

Successful exploitation could lead to the compromise of sensitive data, including user credentials, API keys, and proprietary information. The impact could range from unauthorized access to internal systems and data breaches to complete control over the affected Azure resources. The severity depends on the scope of the captured network traffic and the sensitivity of the data transmitted. Organizations in all sectors utilizing Azure are potentially vulnerable. The number of victims can vary depending on the access level of the compromised account and the targeted resources.

Recommendation

• Deploy the Sigma rules in this brief to your SIEM and tune for your environment to detect malicious packet capture activity in Azure.
• Review Azure activity logs for instances of MICROSOFT.NETWORK/*/STARTPACKETCAPTURE/ACTION, MICROSOFT.NETWORK/*/VPNCONNECTIONS/STARTPACKETCAPTURE/ACTION, or MICROSOFT.NETWORK/*/PACKETCAPTURES/WRITE operations with a Success outcome, as identified in the rule query.
• Implement the recommendations for Response and Remediation provided in the Setup section of the referenced Elastic rule to improve detection and response capabilities.
• Regularly audit Azure user roles and permissions to ensure that only authorized personnel have the ability to manage Network Watcher and initiate packet captures.

]]>mediumadvisoryazurenetwork-sniffingcredential-accesshttps://feed.craftedsignal.io/briefs/2024-01-azure-network-watcher-deletion/Wed, 03 Jan 2024 15:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-azure-network-watcher-deletion/An adversary may delete an Azure Network Watcher to impair defenses by disabling network monitoring and logging capabilities, as detected by monitoring Azure activity logs for Network Watcher deletion events.Azure Network Watcher is a critical tool for monitoring, diagnosing, and logging network activity within Azure virtual networks. This tool provides crucial insights for maintaining network security and performance. An attacker with sufficient privileges can delete a Network Watcher instance to evade defenses by disabling network monitoring, traffic analysis, and logging capabilities. This event can be triggered through the Azure portal, CLI, or API. The deletion event is recorded in Azure Activity Logs, providing a valuable opportunity for detection. Detecting the unauthorized deletion of Network Watchers is crucial for maintaining visibility into the network environment and responding to potential security incidents.

Attack Chain

1. The attacker gains initial access to an Azure account with sufficient privileges to manage Network Watcher resources, potentially through compromised credentials or exploiting a misconfigured service principal.
2. The attacker authenticates to the Azure Resource Manager API or uses the Azure portal with the compromised account.
3. The attacker identifies the target Network Watcher instance within the Azure subscription.
4. The attacker issues a DELETE request to the Azure Resource Manager API targeting the Network Watcher resource, specifically using the "MICROSOFT.NETWORK/NETWORKWATCHERS/DELETE" operation.
5. Azure processes the deletion request, removing the Network Watcher configuration and stopping the associated monitoring and logging activities.
6. The deletion event is recorded in the Azure Activity Logs with an "event.outcome" of "Success" or "success".
7. Without the Network Watcher, the attacker can perform malicious activities within the virtual network with reduced chances of detection.
8. The attacker achieves their objective, such as data exfiltration, lateral movement, or deploying malicious resources, while avoiding network-based monitoring and alerting.

Impact

The deletion of a Network Watcher can significantly impair an organization's ability to detect and respond to network-based threats within their Azure environment. Successful deletion results in the loss of network traffic analysis, packet capture, and flow logging capabilities provided by Network Watcher. The scope of impact depends on the number of virtual networks and resources monitored by the deleted Network Watcher. This can lead to delayed incident response, increased dwell time for attackers, and greater potential for data breaches or other malicious activities.

Recommendation

• Deploy the Sigma rule Azure Network Watcher Deleted to your SIEM and tune for your environment, using Azure activity logs to detect unauthorized deletions of Network Watchers.
• Review Azure activity logs regularly for MICROSOFT.NETWORK/NETWORKWATCHERS/DELETE events to identify potential defense evasion attempts.
• Implement stricter access controls and auditing for Azure resources, ensuring only authorized personnel have the ability to delete critical monitoring tools as described in the overview section.
• Investigate any identified deletions by examining the associated user identity in the activity logs to confirm authorization, as described in the triage section.
• Restore deleted Network Watchers by redeploying them in the affected regions to resume monitoring and logging capabilities, as mentioned in the response section.

]]>mediumadvisorycloudazuredefense-evasion