Cloud-Storage - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/cloud-storage/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 03 Jan 2024 15:30:00 +0000Potential Data Exfiltration via Rclonehttps://feed.craftedsignal.io/briefs/2024-01-rclone-exfiltration/Wed, 03 Jan 2024 15:30:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-rclone-exfiltration/The rule detects the abuse of rclone, a legitimate file synchronization tool, potentially renamed to evade detection, to exfiltrate data to cloud storage or remote endpoints, using copy/sync commands and specific file filters.This detection identifies the potential abuse of rclone, a legitimate command-line program used for managing files on cloud storage, for malicious data exfiltration. Attackers might rename rclone to masquerade it as a security or backup utility and blend it with administrative traffic. They can then use rclone's copy or sync functions with specific cloud backends (like S3) and filters to target and exfiltrate sensitive file types. The use of rclone with suspicious arguments and without legitimate configuration paths can be a strong indicator of malicious activity. This activity is observed on Windows systems. Defenders need to be aware of this technique as it allows attackers to exfiltrate data without using conventional malware.

Attack Chain

  1. An attacker gains initial access to a Windows system (e.g., through compromised credentials or exploiting a vulnerability).
  2. The attacker downloads rclone to the compromised system.
  3. The attacker renames rclone.exe to a less suspicious name (e.g., TrendFileSecurityCheck.exe) to evade detection based on process name.
  4. The attacker uses rclone's copy or sync command to initiate data transfer to a remote cloud storage service such as Amazon S3 or a web server accessible via HTTP.
  5. The attacker uses the --include flag to specify the file types to be exfiltrated (e.g., documents, source code, or databases).
  6. The attacker may use the --transfers flag to increase the number of parallel transfers, speeding up the exfiltration process.
  7. The attacker sets up a cron job to run rclone periodically, ensuring continuous exfiltration of data.
  8. The data is exfiltrated to the attacker's controlled cloud storage, completing the objective.

Impact

Successful exploitation can lead to the exfiltration of sensitive company data, including intellectual property, financial records, or customer data. This data breach can result in financial losses, reputational damage, legal liabilities, and loss of competitive advantage. While the number of victims and sectors are unknown, the consequences of a successful data exfiltration can be severe for any organization.

Recommendation

  • Deploy the Sigma rule "Potential Data Exfiltration via Rclone" to your SIEM and tune for your environment to detect suspicious rclone activity based on process names and command-line arguments.
  • Implement the Sigma rule "Rclone Process Without Standard Path" to alert when rclone is executed from non-standard directories, which could indicate a renamed or moved copy of the tool.
  • Investigate any processes where process.pe.original_file_name is rclone.exe but the process name is different, indicating a possible attempt to evade detection as described in the Overview.
  • Review rclone command-line arguments for usage of copy or sync commands in conjunction with --include or --exclude flags to identify potentially targeted data as noted in the Triage section.
  • Monitor process creation events (Sysmon Event ID 1) for the execution of rclone.exe or renamed copies with unusual command-line arguments, using the provided log source details.
]]>mediumadvisoryexfiltrationrclonecloud storagewindowsAzure Storage Account Data Exfiltration via AzCopy and SAS Token Abusehttps://feed.craftedsignal.io/briefs/2024-01-02-azure-storage-azcopy-exfiltration/Tue, 02 Jan 2024 15:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-02-azure-storage-azcopy-exfiltration/Successful GetBlob operations on Azure Storage Accounts using the AzCopy user agent with SAS token authentication can indicate data exfiltration by adversaries abusing compromised SAS tokens.This threat involves the potential exfiltration of data from Azure Storage Accounts by abusing the AzCopy command-line utility with compromised Shared Access Signature (SAS) tokens. AzCopy is a legitimate tool for transferring data to and from Azure Storage, but adversaries can exploit it to download sensitive data if they gain access to valid SAS tokens. The activity is characterized by successful GetBlob operations originating from the AzCopy user agent and authenticated using SAS tokens. This activity is a concern for defenders because it allows attackers to bypass traditional access controls and exfiltrate data without directly compromising storage account credentials. The Elastic detection rule identifies the first occurrence of GetBlob operations from a specific storage account using this pattern.

Attack Chain

  1. The attacker gains unauthorized access to a valid SAS token for an Azure Storage Account. This could be achieved through phishing, credential stuffing, or exploiting a misconfigured application.
  2. The attacker uses the AzCopy command-line utility on a compromised host or cloud instance.
  3. AzCopy is configured with the compromised SAS token to authenticate against the target Azure Storage Account. The attacker sets the target using the storage account name.
  4. The attacker issues a GetBlob request to retrieve specific blobs. They identify the target using the objectKey.
  5. The Azure Storage Account logs the successful GetBlob operation. The logs include the AzCopy user agent, the SAS token authentication method, and a status code of 200.
  6. The attacker repeats steps 4 and 5 to exfiltrate multiple blobs. They may first use ListBlobs or ListContainers to enumerate storage contents.
  7. The exfiltrated data is stored on the attacker's controlled infrastructure.
  8. The attacker uses the exfiltrated data for malicious purposes, such as extortion, espionage, or financial gain.

Impact

A successful attack can lead to the exfiltration of sensitive data stored within the Azure Storage Account. The damage depends on the sensitivity of the data, which could include confidential business documents, customer data, or proprietary code. The number of victims depends on the scope of the affected storage account. Organizations in any sector that rely on Azure Storage Accounts are at risk. Data breaches can result in financial losses, reputational damage, and legal repercussions.

Recommendation

  • Enable Azure Storage Diagnostic Logs, specifically the StorageRead log, and stream them to an Event Hub for analysis (references: setup section of the content).
  • Deploy the provided Sigma rule to your SIEM to detect suspicious GetBlob operations with the AzCopy user agent and SAS token authentication. Tune the rule to your environment to minimize false positives (reference: rules section below).
  • Review Azure Activity Logs for SAS token generation events to identify potentially compromised tokens (reference: overview section of the content).
  • Implement shorter expiration times and restrictive permissions on SAS tokens to limit the potential impact of compromised credentials (reference: overview section of the content).
  • Investigate alerts generated by the Sigma rule by reviewing the azure.platformlogs.properties.accountName, azure.platformlogs.properties.objectKey, source.address, and azure.platformlogs.identity.tokenHash fields to understand the context of the activity (reference: overview section of the content).
]]>mediumadvisoryazureexfiltrationcloud-storageazcopy