https://feed.craftedsignal.io/tags/account_manipulation/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 03 Jan 2024 18:23:00 +0000https://feed.craftedsignal.io/briefs/2024-01-gworkspace-external-user-group/Wed, 03 Jan 2024 18:23:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-gworkspace-external-user-group/Detection of an external Google Workspace user account being added to an existing group, potentially indicating an adversary attempting to intercept shared files or emails by adding accounts where the domain name of the target doesn't match the Google Workspace domain.This detection identifies instances where an external user account is added to a Google Workspace group. Attackers may leverage this technique to intercept shared files or emails directed to the group. The rule focuses on identifying user accounts where the domain name of the target does not match the Google Workspace domain. The attack often starts with phishing or exploiting container-bound scripts to add external Google accounts to an organization's groups, sometimes granting editorial privileges. This allows the attacker to receive any information shared with the group, leading to potential data leaks or weaponization of documents for further intrusion. Google Workspace administrators may observe lag times ranging from minutes up to 3 days between the time of an event's occurrence and the event being visible in the Google Workspace admin/audit logs.

Attack Chain

1. The attacker performs reconnaissance to identify a target Google Workspace organization and its group structure.
2. A phishing email is crafted to steal credentials of a user with group management privileges or to directly add an external user to a group via a malicious link.
3. Alternatively, the attacker compromises a container-bound script with sufficient privileges to modify group memberships.
4. The compromised user or script adds an external user account (e.g., a Gmail account controlled by the attacker) to a target Google Workspace group.
5. The external user account receives emails and shared files intended for the group, potentially containing sensitive information.
6. The attacker monitors the intercepted communications for valuable data, such as credentials, financial information, or proprietary documents.
7. The stolen information is exfiltrated to an external location.
8. The attacker uses the stolen information to further compromise the organization or its partners.

Impact

Compromising Google Workspace groups can lead to significant data breaches, with potentially thousands of internal documents and communications exposed to unauthorized external actors. Successful attacks can result in the loss of confidential business data, intellectual property theft, and regulatory compliance violations. The targeted groups could range from small teams to company-wide distribution lists, affecting customer data, financial records, and strategic plans. Depending on the group's function, the impact could range from minor data leakage to severe reputational and financial damage, depending on the sensitivity and volume of data accessed.

Recommendation

• Deploy the Sigma rule "External User Added to Google Workspace Group" to your SIEM to detect suspicious group membership changes.
• Investigate alerts generated by the Sigma rule by examining the user.name or user.email and the group.name fields to identify involved accounts and groups.
• Review Google Workspace audit logs for event.action: "ADD_GROUP_MEMBER" to identify other group modifications and potential external user additions.
• Implement multi-factor authentication (MFA) for all Google Workspace accounts, particularly those with administrative privileges, to mitigate credential theft.
• Enforce strict access control policies and regularly review group memberships to ensure only authorized users have access to sensitive data.
• Configure alerts for unusual activity, such as external account additions to internal groups, to reduce the mean time to detect (MTTD).

]]>mediumadvisorygoogle_workspaceinitial_accessaccount_manipulationhttps://feed.craftedsignal.io/briefs/2024-01-03-entra-id-application-credential-modification/Wed, 03 Jan 2024 10:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-03-entra-id-application-credential-modification/An adversary may add unauthorized credentials to an Azure application, enabling persistent access, evading defenses, and escalating privileges by modifying certificates or secrets.This detection identifies when a new credential is added to an application in Azure. Azure applications use credentials like certificates or secret strings for identity verification during token requests. Adversaries may exploit this by adding unauthorized credentials, enabling persistent access or evading defenses. This tactic allows attackers to maintain access even if the original compromised account is remediated. The targeted applications are within the Entra ID environment. This activity is logged within the Azure audit logs and can be detected by monitoring for successful "Update application - Certificates and secrets management" operations.

Attack Chain

1. The attacker gains initial access to an account with permissions to modify Azure application registrations (e.g., via phishing or credential stuffing).
2. The attacker identifies a target application registration within Entra ID.
3. The attacker modifies the application registration to add a new certificate or secret string credential.
4. The attacker uses the newly added credential to authenticate as the application.
5. The attacker leverages the application's permissions to access resources within the Azure environment.
6. The attacker may escalate privileges by granting the application additional roles or permissions.
7. The attacker maintains persistent access to the Azure environment even if the initially compromised account is disabled.

Impact

Successful exploitation allows attackers to maintain a persistent foothold within the Azure environment, even after the initial compromise is remediated. This can lead to data exfiltration, unauthorized access to resources, and further lateral movement within the cloud infrastructure. The severity depends on the application's permissions and the scope of the attacker's access, but could affect critical business functions if a high-privilege application is compromised.

Recommendation

• Deploy the Sigma rule "Entra ID Application Credential Modified" to detect unauthorized credential modifications within your Azure environment, ingesting logs-azure.auditlogs-* and filebeat-* indices.
• Review Azure audit logs for the "Update application - Certificates and secrets management" operation name to identify potential malicious activity.
• Implement stricter access controls and multi-factor authentication for accounts with permissions to manage Azure application registrations.
• Monitor application access logs for unusual or unauthorized activity originating from application principals with newly added credentials.
• Correlate application credential modifications with other suspicious activities, such as failed login attempts or privilege escalation events, to identify potential indicators of compromise.

]]>mediumadvisoryazurepersistenceentra_idaccount_manipulation