https://feed.craftedsignal.io/tags/accounttakeover/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 03 Jan 2024 12:00:00 +0000https://feed.craftedsignal.io/briefs/2024-01-azure-ad-service-principal-auth/Wed, 03 Jan 2024 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-azure-ad-service-principal-auth/This analytic identifies authentication events of service principals in Azure Active Directory, monitoring sign-in frequency, timing, source IPs, and accessed resources to detect potential anomalies indicative of compromised credentials or malicious activities.This analytic focuses on detecting suspicious authentication patterns of service principals within Azure Active Directory. Service principals are non-human identities used by applications and services to access Azure resources. Monitoring their authentication activity is crucial because compromised service principal credentials can grant attackers unauthorized access to sensitive data and services. The detection logic analyzes Azure AD sign-in logs (ServicePrincipalSignInLogs) to identify anomalies in sign-in frequency, source IP addresses, accessed resources, and other relevant attributes. Analyzing service principal authentication is vital for SOC teams as it allows them to distinguish between legitimate application behavior and potentially malicious activities, such as account takeovers. This detection is designed to work with data ingested via the Splunk Add-on for Microsoft Cloud Services.

Attack Chain

1. The attacker gains unauthorized access to a service principal's credentials through credential stuffing or other means.
2. The attacker uses the compromised service principal credentials to authenticate to Azure AD.
3. The attacker leverages the authenticated service principal to access resources within the Azure environment.
4. The attacker attempts to elevate privileges by accessing resources and services that the service principal is authorized to manage.
5. The attacker compromises sensitive data by accessing storage accounts, databases, or other data repositories.
6. The attacker moves laterally within the Azure environment by using the compromised service principal to authenticate to other resources and services.
7. The attacker establishes persistence by creating new service principals or modifying existing ones.
8. The attacker exfiltrates sensitive data from the Azure environment.

Impact

A successful attack targeting Azure AD service principals can have severe consequences, including unauthorized access to critical resources, data breaches, and lateral movement within the Azure environment. Attackers can leverage compromised service principals to steal sensitive data, disrupt services, and escalate privileges. Depending on the scope of access, the damage could range from a targeted data breach to a widespread compromise of the entire Azure environment.

Recommendation

• Deploy the Sigma rule "Azure AD Service Principal Authentication Anomaly" to your SIEM and tune for your environment.
• Investigate any alerts generated by the Sigma rule "Azure AD Service Principal Authentication Anomaly" to determine if the activity is legitimate or malicious.
• Enable Azure Active Directory Sign-in activity logging to capture the necessary data for this detection.
• Review service principal permissions regularly to ensure that they are least-privilege and appropriate for the service's function.
• Implement multi-factor authentication (MFA) for service principals where possible to prevent unauthorized access.
• Monitor the azure_monitor_aad data source, specifically targeting "Sign-in activity" within ServicePrincipalSignInLogs.

]]>highadvisoryazureazureadserviceprincipalaccounttakeoverhttps://feed.craftedsignal.io/briefs/2024-01-03-azure-ad-device-code-phishing/Wed, 03 Jan 2024 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-03-azure-ad-device-code-phishing/This brief details the detection of Azure AD Device Code Phishing attacks, where attackers bypass MFA and Conditional Access Policies (CAPs) to gain unauthorized access to Azure AD resources by abusing the device code authentication protocol.Attackers are increasingly using Device Code Phishing to bypass Multi-Factor Authentication (MFA) and Conditional Access Policies in Azure Active Directory. This technique involves tricking users into entering a device code on a fake Microsoft login page, granting the attacker access to their accounts. This attack leverages the legitimate device code authentication flow, making it harder to detect than traditional phishing attacks. Successful device code phishing can lead to account takeover, data breaches, and unauthorized access to sensitive resources within the Azure AD environment, including Exchange mailboxes and Outlook Web Application (OWA). Defenders need to monitor for unusual device code authentication activity to mitigate the risk of these attacks. The technique abuses the OAuth 2.0 device authorization grant flow, designed for devices without a browser.

Attack Chain

1. The attacker sends a phishing email to the target user. This email contains a link to a fake Microsoft login page.
2. The user clicks the link and is prompted to enter a code. The attacker initiates a device code authentication flow on a compromised or attacker-controlled device.
3. The attacker obtains a device code and presents it to the victim through the phishing page.
4. The user enters the device code on the fake Microsoft login page, unknowingly authorizing the attacker's device.
5. The attacker's device requests an access token from Azure AD using the device code.
6. Azure AD validates the device code and, if valid, prompts the user (via the legitimate Microsoft authentication flow, but on the attacker's device) to authenticate and grant permissions.
7. The user authenticates and grants the requested permissions, completing the device code authentication flow on the attacker's device.
8. The attacker obtains an access token and can now access the user's Azure AD resources, such as Exchange mailboxes and OWA, without needing to bypass MFA on their primary device.

Impact

Successful Azure AD device code phishing attacks can result in account takeovers, data breaches, and unauthorized access to sensitive resources. Attackers can gain access to Exchange mailboxes, Outlook Web Application (OWA), and other Azure AD-protected applications. The impact can range from data exfiltration and business email compromise to lateral movement within the Azure environment. This can lead to significant financial losses, reputational damage, and compliance violations. The number of victims and sectors targeted can vary, but the potential for widespread impact is high, especially in organizations with weak security awareness training.

Recommendation

• Deploy the Sigma rule Azure AD Device Code Authentication Activity to detect suspicious device code authentication requests in Azure AD SignInLogs.
• Implement enhanced security awareness training to educate users about device code phishing attacks and how to identify fake login pages.
• Monitor Azure AD SignInLogs for unusual authentication patterns, such as device code authentications from unfamiliar locations or devices.
• Configure Conditional Access Policies to restrict device code authentication to trusted devices and locations.
• Review and harden Conditional Access Policies to prevent bypasses via device code authentication, referencing the Microsoft documentation on device code flows: https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-device-code
• Enable logging of Azure AD sign-in events and ensure that logs are ingested into a SIEM or security analytics platform for analysis.

]]>highadvisoryazureaddevicecodephishingaccounttakeovercredentialaccess