PingID - CraftedSignal Threat Feed

PingID New MFA Method Registered For User

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

This threat brief focuses on detecting the registration of new Multi-Factor Authentication (MFA) methods within PingID (PingOne) environments. The detection leverages JSON logs from PingID, specifically focusing on successful device pairing events. An attacker who gains unauthorized access to a user account may register a new MFA method to maintain persistence, bypass existing security measures, and potentially escalate privileges. This activity is particularly relevant for defenders because successful MFA enrollment by an attacker can grant them long-term access, even if the initial compromise is detected and remediated. The activity described here was reported to start being tracked around January 2023.

Attack Chain

Initial Access: An attacker compromises a user's credentials through phishing, credential stuffing, or other means.
Authentication Bypass: The attacker uses the compromised credentials to attempt to log in to a PingID-protected application.
MFA Enrollment: Upon being prompted for MFA, the attacker initiates the enrollment of a new device.
Device Pairing: The attacker successfully pairs a device they control with the user's account, registering it as a trusted MFA factor. This event is logged as "Device Paired" with status "SUCCESS" in PingID logs.
Persistence: With the new MFA device registered, the attacker can now bypass legitimate MFA challenges.
Lateral Movement: The attacker uses their persistent access to move laterally within the network, accessing other systems and data.
Privilege Escalation: The attacker leverages their access and control to escalate privileges and gain administrative access.

Impact

A successful attack can lead to unauthorized access to sensitive data, systems, and applications. The number of victims depends on the scope of the compromised user accounts and the attacker's ability to move laterally within the network. Sectors that rely heavily on PingID for access control are particularly vulnerable, including finance, healthcare, and government. If the attack succeeds, the organization may suffer data breaches, financial losses, and reputational damage.

Recommendation

Enable JSON logging from PingID via Webhook or Push Subscription to ensure proper data ingestion for the Sigma rules (How to Implement).
Deploy the Sigma rule "PingID New MFA Device Registered" to detect suspicious MFA registrations in your environment (Sigma Rule).
Investigate any alerts generated by the Sigma rule, focusing on users with recent suspicious activity or known compromised accounts (Sigma Rule).
Review PingID logs for "Device Unpaired" events which can indicate MFA device removal by the attacker (Search Query).
Monitor network traffic for connections originating from newly registered MFA devices to identify potential attacker activity (Network Logs).

PingID New MFA Method After Credential Reset

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

This analytic identifies suspicious activity where a new MFA device is paired with a user account in PingID shortly after a password reset. The detection logic correlates Windows Event Logs for password changes (Event ID 4723, 4724) with PingID logs indicating device pairing events. This behavior is significant because it can indicate a social engineering attack, where a threat actor impersonates a valid user to reset their credentials and add a new MFA device under their control. The observed activity focuses on gaining unauthorized access to user accounts by bypassing traditional security measures through MFA manipulation. The timeframe analyzed is within one hour of the password reset.

Attack Chain

The attacker conducts reconnaissance to identify a target user within the organization.
The attacker initiates a password reset for the target user, possibly through social engineering or exploiting a vulnerability in the password reset process.
Windows Event Logs record a password change event (Event ID 4723 or 4724) on the Active Directory Domain Controller.
The attacker pairs a new MFA device with the target user's PingID account. This could involve intercepting the original MFA device or using other unknown MFA enrollment bypass techniques.
PingID logs record a "Device Paired" event, including information about the device (e.g., IP address, device model).
The attacker leverages the newly paired MFA device to authenticate as the target user, bypassing legitimate MFA controls.
The attacker gains unauthorized access to sensitive applications, data, and resources accessible to the target user.

Impact

A successful attack allows the adversary to gain persistent access to a compromised account, bypassing multi-factor authentication. This could lead to unauthorized access to sensitive data, financial fraud, or further lateral movement within the organization. The impact includes potential data breaches, reputational damage, and financial loss. The references suggest that MFA fatigue is becoming a more common attack vector.

Recommendation

Deploy the Sigma rule PingID New MFA Method After Credential Reset to your SIEM and tune the timeDiffRaw parameter for your environment to reduce false positives.
Enable Windows Event Log collection on Active Directory Domain Controllers to capture password change events (Event ID 4723, 4724) as required by the provided Sigma rule.
Ingest PingID logs, either via Webhook or Push Subscription, into your SIEM to enable correlation with password reset events for identifying potential MFA takeover attempts as used by the Sigma rule.
Implement stricter password reset policies and MFA enrollment procedures to reduce the risk of social engineering attacks.

PingID MFA Bombing Attack

hello@craftedsignal.io — Tue, 02 Jan 2024 12:00:00 +0000

This brief addresses the threat of MFA fatigue attacks targeting PingID environments. The attack involves overwhelming a user with numerous MFA push notifications in a short period, hoping they will eventually approve one accidentally or out of frustration. While the source doesn't attribute this activity to a specific actor, similar techniques have been associated with financially motivated groups and nation-state actors. The detection logic focuses on identifying users with 10 or more failed MFA attempts within a 10-minute window, using JSON logs from PingID. Defenders need to be aware of this technique as a successful bypass could grant attackers initial access or privilege escalation within the targeted network.

Attack Chain

The attacker gains initial access using previously compromised credentials or through credential harvesting.
The attacker attempts to authenticate to a resource protected by PingID.
PingID prompts the legitimate user for MFA.
The attacker initiates repeated login attempts in rapid succession.
PingID sends multiple MFA push notifications to the user's registered device.
The user is bombarded with MFA requests and may accidentally or unknowingly approve one.
Upon successful MFA bypass, the attacker gains unauthorized access to the targeted resource or system.
The attacker performs malicious activities such as data exfiltration, lateral movement, or privilege escalation.

Impact

A successful MFA fatigue attack can lead to a full compromise of user accounts, granting attackers access to sensitive data and systems. This can result in data breaches, financial losses, and reputational damage. While this technique can affect any organization using PingID for MFA, sectors with high-value data, such as finance and healthcare, may be particularly attractive targets. If successful, the attacker can bypass an intended security control and gain unauthorized access to critical resources.

Recommendation

Deploy the Sigma rule Detect PingID Multiple Failed MFA Requests to your SIEM to identify potential MFA fatigue attacks in real-time, tuning the threshold (mfa_prompts >= 10) to suit your environment.
Investigate any alerts generated by the Sigma rule Detect PingID Multiple Failed MFA Requests to determine the legitimacy of the MFA requests and user behavior.
Implement user education programs to raise awareness about MFA fatigue attacks and advise users to reject any unexpected or excessive MFA requests.
Review and adjust PingID MFA settings to potentially limit the number of allowed MFA attempts within a specific time frame to mitigate the impact of MFA bombing.
Consider implementing additional security measures, such as IP-based access restrictions, to further protect against unauthorized access attempts.