PingOne - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/pingone/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 03 Jan 2024 12:00:00 +0000PingID New MFA Method Registered For Userhttps://feed.craftedsignal.io/briefs/2024-01-pingid-mfa-registration/Wed, 03 Jan 2024 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-pingid-mfa-registration/The creation of a new MFA registration in PingID could indicate an attacker attempting to maintain persistence after compromising a user account.This threat brief focuses on detecting the registration of new Multi-Factor Authentication (MFA) methods within PingID (PingOne) environments. The detection leverages JSON logs from PingID, specifically focusing on successful device pairing events. An attacker who gains unauthorized access to a user account may register a new MFA method to maintain persistence, bypass existing security measures, and potentially escalate privileges. This activity is particularly relevant for defenders because successful MFA enrollment by an attacker can grant them long-term access, even if the initial compromise is detected and remediated. The activity described here was reported to start being tracked around January 2023.

Attack Chain

  1. Initial Access: An attacker compromises a user's credentials through phishing, credential stuffing, or other means.
  2. Authentication Bypass: The attacker uses the compromised credentials to attempt to log in to a PingID-protected application.
  3. MFA Enrollment: Upon being prompted for MFA, the attacker initiates the enrollment of a new device.
  4. Device Pairing: The attacker successfully pairs a device they control with the user's account, registering it as a trusted MFA factor. This event is logged as "Device Paired" with status "SUCCESS" in PingID logs.
  5. Persistence: With the new MFA device registered, the attacker can now bypass legitimate MFA challenges.
  6. Lateral Movement: The attacker uses their persistent access to move laterally within the network, accessing other systems and data.
  7. Privilege Escalation: The attacker leverages their access and control to escalate privileges and gain administrative access.

Impact

A successful attack can lead to unauthorized access to sensitive data, systems, and applications. The number of victims depends on the scope of the compromised user accounts and the attacker's ability to move laterally within the network. Sectors that rely heavily on PingID for access control are particularly vulnerable, including finance, healthcare, and government. If the attack succeeds, the organization may suffer data breaches, financial losses, and reputational damage.

Recommendation

  • Enable JSON logging from PingID via Webhook or Push Subscription to ensure proper data ingestion for the Sigma rules (How to Implement).
  • Deploy the Sigma rule "PingID New MFA Device Registered" to detect suspicious MFA registrations in your environment (Sigma Rule).
  • Investigate any alerts generated by the Sigma rule, focusing on users with recent suspicious activity or known compromised accounts (Sigma Rule).
  • Review PingID logs for "Device Unpaired" events which can indicate MFA device removal by the attacker (Search Query).
  • Monitor network traffic for connections originating from newly registered MFA devices to identify potential attacker activity (Network Logs).
]]>highadvisorypingidmfapersistencecredential-access