https://feed.craftedsignal.io/tags/bloodhound/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 30 Jan 2024 12:00:00 +0000https://feed.craftedsignal.io/briefs/2024-01-30-bloodhound-collection/Tue, 30 Jan 2024 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-30-bloodhound-collection/Adversaries may use the SharpHound tool to collect Active Directory data, saving it into default JSON files for BloodHound analysis, potentially leading to privilege escalation or lateral movement.BloodHound is a popular tool used to map relationships within Active Directory environments, enabling attackers to identify attack paths for privilege escalation. SharpHound is a data collector for BloodHound, written in C#, that gathers information about users, groups, computers, and other objects in the Active Directory domain. Detection of SharpHound's data collection activity is crucial to identify potential reconnaissance attempts by attackers aiming to map out attack vectors within the network. This activity often precedes lateral movement and privilege escalation attempts.

Attack Chain

1. An attacker gains initial access to a system within the target environment (e.g., via compromised credentials or exploiting a vulnerability).
2. The attacker executes SharpHound.exe on the compromised system. This could be done via command line execution or a script.
3. SharpHound enumerates users, groups, computers, organizational units (OUs), Group Policy Objects (GPOs), and containers within the Active Directory domain.
4. SharpHound writes the collected data to JSON files with default names such as _users.json, _computers.json, _groups.json, _ous.json, _gpos.json, and _containers.json.
5. The attacker may compress these JSON files into a BloodHound.zip archive for easier transfer.
6. The attacker exfiltrates the collected data from the compromised system to a location where they can analyze it with BloodHound.
7. Using BloodHound, the attacker analyzes the collected data to identify attack paths and potential privilege escalation opportunities.
8. The attacker leverages identified attack paths to move laterally within the network and escalate privileges.

Impact

Successful BloodHound data collection allows attackers to map out attack paths within the Active Directory environment. This can lead to privilege escalation, lateral movement, and ultimately, compromise of critical assets. Depending on the targeted environment, this can impact hundreds or thousands of systems and user accounts.

Recommendation

• Deploy the Sigma rule "BloodHound Collection Files" to your SIEM to detect the creation of BloodHound data collection files (reference: rules section).
• Monitor file creation events for files ending with _computers.json, _containers.json, _gpos.json, _groups.json, _ous.json, _users.json, and BloodHound.zip (reference: rules section).
• Implement network segmentation to limit the scope of potential BloodHound data collection activities (reference: attack chain).
• Restrict the use of tools like SharpHound within the environment to authorized personnel only (reference: overview).

]]>highadvisorybloodhoundactive-directoryreconnaissanceprivilege-escalationhttps://feed.craftedsignal.io/briefs/2024-01-bloodhound-azuread-discovery/Tue, 09 Jan 2024 18:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-bloodhound-azuread-discovery/Detection of BloodHound tools like AzureHound and SharpHound being used to enumerate Microsoft Entra ID and Microsoft 365 environments, potentially indicating reconnaissance activity by red teams or malicious actors.This threat brief focuses on the detection of reconnaissance activities within Microsoft Azure and Microsoft 365 environments through the use of BloodHound tools. Specifically, it addresses the use of AzureHound, SharpHound, and BloodHound by adversaries or red teams to map out users, groups, roles, applications, and access relationships within Microsoft Entra ID (Azure AD). The Elastic detection rule published on 2026-04-10 identifies activity based on the presence of suspicious user agent strings (e.g., azurehound/, sharphound/, bloodhound/) in various Azure and M365 logs. This technique allows attackers to gain a comprehensive understanding of the target environment's structure and potential vulnerabilities, often as a precursor to further exploitation. The scope of the detection includes Azure Graph API Activity Logs, Microsoft 365 Audit Logs, Entra ID Sign-in Logs, Entra ID Audit Logs, and Azure Activity Logs.

Attack Chain

1. Initial Access: The attacker gains initial access to a compromised account or obtains valid credentials.
2. Tool Deployment: The attacker deploys a BloodHound tool (AzureHound, SharpHound) on a compromised system or uses a cloud-based instance.
3. Authentication: The tool authenticates to Azure AD using the compromised credentials or a service principal.
4. Enumeration: The BloodHound tool begins enumerating users, groups, roles, applications, and access relationships using the Microsoft Graph API. This involves sending numerous API requests.
5. Data Collection: The tool collects data about the Azure AD environment, including user details, group memberships, role assignments, and application permissions. API endpoints such as /v1.0/users, /v1.0/groups, and /v1.0/organization are accessed.
6. Data Analysis: The collected data is analyzed to identify potential attack paths, such as privileged accounts, weak access controls, and lateral movement opportunities.
7. Privilege Escalation (Potential): Based on the identified attack paths, the attacker attempts to escalate privileges or gain access to sensitive resources.
8. Lateral Movement (Potential): Using compromised credentials or service principals, the attacker moves laterally within the Azure AD environment to access additional resources and data.

Impact

Successful enumeration using BloodHound tools can expose the entire structure of an Azure AD environment, leading to significant security risks. This includes the potential for privilege escalation, lateral movement, and data exfiltration. Attackers can leverage the gathered information to identify critical assets, high-value accounts, and vulnerable configurations, enabling them to launch targeted attacks. The impact could affect organizations of any size relying on Azure AD and Microsoft 365 for identity management and cloud services. If exploited, attackers can pivot to critical infrastructure and cause severe business disruptions.

Recommendation

• Deploy the Sigma rule "Entra ID Sign-in BloodHound Suite User-Agent Detected" to your SIEM and tune for your environment to detect enumeration attempts.
• Enable verbose audit logging on Azure AD and Microsoft 365 services to capture detailed information about API requests, sign-in attempts, and user activity.
• Review the false positives outlined in the overview section of the rule and implement appropriate allowlist conditions based on app_id, user context or source address.
• Implement Conditional Access policies in Azure AD to enforce multi-factor authentication (MFA) for all users, especially for privileged accounts and API access.
• Regularly review and reduce excessive privileges assigned to users and service principals to minimize the impact of potential breaches.

]]>mediumadvisoryazureadbloodhoundenumerationdiscovery