https://feed.craftedsignal.io/products/privileged-identity-management/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 04 Jan 2024 12:00:00 +0000https://feed.craftedsignal.io/briefs/2024-01-entra-id-pim-global-admin-role-addition/Thu, 04 Jan 2024 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-entra-id-pim-global-admin-role-addition/An adversary may add an account to the Global Administrator role within Azure AD Privileged Identity Management (PIM) to establish persistence and gain privileged access.This alert identifies when a user is added to the Global Administrator role in Azure Active Directory (Azure AD) through Privileged Identity Management (PIM). Azure AD Global Administrator roles grant extensive permissions allowing modification of any administrative setting within the Azure AD organization. Privileged Identity Management (PIM) is used to manage, control, and monitor access to important resources. An adversary might add themselves, or another account they control, to the Global Administrator role via PIM to gain persistent, highly privileged access to the Azure environment. This could lead to data exfiltration, service disruption, or further lateral movement within the cloud environment. The rule specifically looks for "Add eligible member to role in PIM completed (permanent)" or "Add member to role in PIM completed (timebound)" events.

Attack Chain

1. The attacker compromises an existing user account with sufficient privileges to manage roles in Azure AD PIM, possibly via phishing (T1566).
2. The attacker authenticates to the Azure portal using the compromised account.
3. The attacker navigates to the Privileged Identity Management (PIM) service within Azure AD.
4. The attacker initiates a request to add a target user account (potentially themselves or an account they control) to the Global Administrator role.
5. The attacker completes the process of assigning the Global Administrator role to the target user, either permanently or with a time-bound assignment, using the compromised account's permissions.
6. Azure AD logs an audit event indicating the successful addition of the user to the Global Administrator role in PIM. The azure.auditlogs.operation_name will contain "Add eligible member to role in PIM completed (permanent)" or "Add member to role in PIM completed (timebound)".
7. The attacker leverages the newly assigned Global Administrator privileges to perform malicious actions such as modifying security settings, accessing sensitive data, or deploying malicious applications.
8. The attacker maintains persistence by ensuring the Global Administrator role assignment remains active, allowing continued access to the environment.

Impact

Successful exploitation allows the attacker to gain full control over the Azure AD environment. A Global Administrator can read and modify any administrative setting. This includes the ability to create new users, reset passwords, modify security policies, access all data stored in the cloud environment, and disrupt critical services. The impact could range from data breaches and financial losses to complete compromise of the organization's cloud infrastructure.

Recommendation

• Deploy the Sigma rule "Entra ID Global Administrator Role Assigned (PIM User)" to your SIEM and tune for your environment to detect unauthorized role assignments (rule).
• Review Azure AD audit logs for any unexpected additions of users to highly privileged roles, especially the Global Administrator role (logsource).
• Implement multi-factor authentication (MFA) for all user accounts, especially those with administrative privileges, to reduce the risk of account compromise (T1566).
• Enforce the principle of least privilege by granting users only the minimum necessary permissions to perform their job functions.
• Regularly review and audit role assignments in Azure AD to identify and remove any unnecessary or excessive privileges.
• Implement alerts for any changes to PIM settings to detect potential tampering with privileged access management controls (logsource).

]]>highadvisoryazureentra_idpersistenceprivilege_escalationhttps://feed.craftedsignal.io/briefs/2024-01-azure-ad-pim-activation/Wed, 03 Jan 2024 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-azure-ad-pim-activation/Detection of Azure AD Privileged Identity Management (PIM) role activation, indicating potential privilege escalation or unauthorized access.This brief focuses on detecting the activation of Azure AD Privileged Identity Management (PIM) roles, a critical security concern. PIM allows users to activate elevated privileges on demand, but unauthorized or malicious activation can lead to significant security breaches. The detection leverages Azure Active Directory audit logs, specifically targeting the "Add member to role completed (PIM activation)" event. Successful exploitation can enable adversaries to perform administrative actions, exfiltrate sensitive data, or further compromise the Azure environment. Defenders should closely monitor PIM role activations to identify and respond to potentially malicious activity. The analytic is designed for use with the azure:monitor:aad sourcetype, which uses the AuditLog log category.

Attack Chain

1. An attacker gains initial access to a user account within the Azure AD environment (e.g., through phishing or credential stuffing).
2. The attacker identifies a PIM role that would grant them elevated privileges necessary to achieve their objectives.
3. The attacker attempts to activate the targeted PIM role. This triggers an "Add member to role completed (PIM activation)" event in the Azure AD audit logs.
4. Azure AD validates the activation request based on configured policies (e.g., MFA, approval workflows).
5. If the activation is successful, the attacker's account is temporarily granted the privileges associated with the PIM role.
6. The attacker leverages the elevated privileges to perform malicious actions, such as creating new user accounts with administrative rights, modifying security policies, or accessing sensitive data.
7. The attacker attempts to maintain persistence by creating backdoors or modifying existing configurations to ensure continued access even after the PIM role expires.
8. The attacker achieves their final objective, which may include data exfiltration, service disruption, or further lateral movement within the Azure environment.

Impact

Successful exploitation can lead to unauthorized administrative actions, data breaches, or further compromise of the Azure environment. The number of potential victims depends on the scope of the compromised account and the permissions granted by the activated PIM role. Industries relying heavily on Azure AD for identity and access management are particularly vulnerable. The financial impact could be substantial due to data loss, regulatory fines, and incident response costs.

Recommendation

• Deploy the Sigma rule Azure AD PIM Role Activated to your SIEM to detect unauthorized PIM role activations based on the "Add member to role completed (PIM activation)" operation.
• Investigate any detected PIM role activations where the initiatedBy field does not match expected administrative accounts.
• Review and harden PIM policies to require multi-factor authentication (MFA) and approval workflows for role activation, as referenced in the Microsoft documentation.
• Enable Azure AD audit log collection and ensure that the azure:monitor:aad sourcetype is properly configured in Splunk.
• Use the provided drilldown searches to investigate the user and associated risk events.

]]>highadvisoryazurepimprivilege-escalationpersistence