https://feed.craftedsignal.io/tags/compromised-account/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 03 Jan 2024 17:30:00 +0000https://feed.craftedsignal.io/briefs/2024-01-03-azure-ad-concurrent-sessions/Wed, 03 Jan 2024 17:30:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-03-azure-ad-concurrent-sessions/Detection of Azure AD accounts with concurrent sessions originating from multiple unique IP addresses within a 5-minute window, potentially indicating session hijacking and unauthorized access.This analytic identifies Azure AD accounts exhibiting concurrent sessions originating from multiple unique IP addresses within a short timeframe. The detection leverages Azure Active Directory NonInteractiveUserSignInLogs to analyze successful authentication events and count distinct source IPs within a 5-minute window. The activity is flagged as suspicious due to the potential for session hijacking, where an attacker uses stolen session cookies (possibly obtained via phishing kits like Evilginx2) to access corporate resources from geographically diverse locations. Successful session hijacking could lead to unauthorized access to sensitive information and potential data breaches. This detection is relevant for organizations using Azure AD for authentication and authorization. The original Splunk query was published on 2026-04-17.

Attack Chain

1. Attacker compromises user credentials or obtains session cookies via phishing or other methods (e.g., Evilginx2).
2. Attacker initiates a session from a new IP address, potentially outside the user's typical geographic location.
3. The user also has a legitimate session active from their usual location.
4. Azure AD records successful authentication events from both the attacker's IP and the user's legitimate IP.
5. The analytic detects the concurrent sessions from different IP addresses for the same user within a 5-minute window.
6. The attacker leverages the hijacked session to access corporate resources, such as email, cloud storage, or internal applications.
7. Attacker performs unauthorized actions, potentially including data exfiltration, privilege escalation, or lateral movement.

Impact

Successful exploitation can lead to unauthorized access to sensitive data, including customer information, financial records, and intellectual property. The number of affected users depends on the scale of the initial compromise. Organizations in all sectors are potentially vulnerable. A successful attack may result in financial losses, reputational damage, and regulatory fines due to data breaches.

Recommendation

• Deploy the Sigma rule Azure AD Concurrent Sessions From Different IPs to your SIEM and tune the threshold (unique_ips > 1) to fit your environment.
• Investigate alerts generated by the Azure AD Concurrent Sessions From Different IPs rule, focusing on users with high-value accounts or access to sensitive data.
• Implement multi-factor authentication (MFA) to mitigate the risk of credential compromise.
• Review Azure AD sign-in logs for suspicious activity, such as logins from unfamiliar locations or devices.
• Monitor network traffic for connections to known phishing domains or command-and-control servers, referencing external threat intelligence feeds.

]]>highadvisoryazureazureadcompromised-accounthttps://feed.craftedsignal.io/briefs/2024-01-azure-ad-multi-ip-auth/Wed, 03 Jan 2024 10:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-azure-ad-multi-ip-auth/An Azure AD account successfully authenticating from multiple unique IP addresses within a 30-minute window, detected using Azure AD SignInLogs, which may indicate compromised credentials and unauthorized access to corporate resources.This analytic identifies suspicious Azure Active Directory (AD) account activity characterized by successful authentications originating from multiple distinct IP addresses within a short time frame (30 minutes). This behavior is detected by analyzing Azure AD SignInLogs. This activity can indicate that an attacker has gained unauthorized access to an account, potentially through credential compromise following a phishing campaign or other means. Successful exploitation can lead to unauthorized access to sensitive data, internal systems, and further malicious activities within the Azure AD environment.

Attack Chain

1. An attacker gains access to valid Azure AD credentials through phishing, credential stuffing, or other means (T1110, T1566).
2. The attacker attempts to authenticate to Azure AD using the compromised credentials.
3. The legitimate user may also authenticate normally from their usual location.
4. The attacker successfully authenticates from a different IP address than the legitimate user.
5. Azure AD SignInLogs record successful authentication events, including the source IP address (src), user, and other relevant details.
6. A security monitoring system detects multiple successful authentications from different IP addresses for the same user within a 30-minute window.
7. The attacker leverages the compromised account to access cloud resources, applications, and data within the Azure environment.

Impact

Successful exploitation of compromised Azure AD accounts can lead to significant damage. This includes unauthorized access to sensitive data stored within cloud applications, potential data breaches, and the ability for attackers to move laterally within the Azure environment. Affected organizations may experience financial losses, reputational damage, and legal liabilities.

Recommendation

• Deploy the Sigma rule Azure AD Successful Authentication From Different IPs to your SIEM and tune the threshold for unique_ips based on your environment to reduce false positives.
• Investigate any alerts generated by the Sigma rule to determine if the user account has been compromised.
• Implement multi-factor authentication (MFA) to mitigate the risk of credential compromise.
• Monitor Azure AD SignInLogs for unusual authentication patterns, such as logins from unfamiliar locations or devices.

]]>highadvisoryazurecredential-accesscompromised-account