Zoom Meetings Created Without Passcodes

hello@craftedsignal.io — Mon, 29 Jan 2024 12:00:00 +0000

This brief focuses on the risk associated with Zoom meetings created without a passcode. When meetings lack this basic security measure, they become vulnerable to "Zoombombing," where unauthorized individuals disrupt the session with offensive or inappropriate content. The Elastic detection rule, published on 2026-04-10, identifies such meetings by monitoring Zoom event logs. This is particularly relevant for organizations using Zoom for internal and external communication, as the lack of a passcode can lead to reputational damage, exposure of sensitive information, and overall disruption of business operations. Ensuring that all meetings are password-protected is a simple yet effective way to mitigate this risk.

Attack Chain

A Zoom meeting is created by a user without enabling the passcode feature.
The meeting details (including the meeting ID) are potentially shared publicly or become discoverable through automated tools.
Attackers or malicious actors identify the unprotected Zoom meeting.
Attackers join the meeting without any authentication or authorization.
Once inside the meeting, attackers disrupt the session by sharing inappropriate content (e.g., images, videos, audio).
Participants within the meeting are exposed to the offensive content, leading to disruption and potential reputational damage.
The meeting organizer is forced to terminate the session to stop the disruption.
The organization experiences a loss of productivity and may face public criticism due to the incident.

Impact

Failure to secure Zoom meetings with passcodes can lead to significant disruptions, with potential exposure of sensitive information and reputational damage. While the exact number of victims is difficult to quantify, Zoombombing incidents have affected organizations across various sectors. Successful attacks can result in the shutdown of meetings, loss of productivity, and the need for damage control. The impact extends beyond immediate disruption to potential long-term damage to an organization's reputation and client trust.

Recommendation

Deploy the Sigma rule provided below to detect Zoom meetings created without a password.
Enable Zoom Filebeat module to properly ingest the Zoom logs required for detection.
Review Zoom configuration settings to enforce mandatory passcodes for all future meetings.
Implement enhanced monitoring and alerting for Zoom meeting creation events to quickly detect and respond to any future instances of meetings being set up without passcodes.
Educate users on the importance of using passcodes for all Zoom meetings to prevent unauthorized access and potential disruptions.

Azure Key Vault Modified by Unusual User

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

This detection identifies modifications to Azure Key Vault, a service that safeguards encryption keys and secrets. Given the sensitivity of the data stored, access should be tightly controlled. This detection uses a new terms rule to identify when Key Vault modifications are performed by a user who hasn't been seen performing this activity within a 14-day period. This activity could indicate compromised credentials, insider threats, or misconfigured access controls. This rule helps security teams quickly identify and respond to potentially unauthorized modifications to sensitive resources within Azure environments, specifically targeting unusual user activity that deviates from established baselines. The original rule was created on 2020/08/31, and updated on 2026/04/10.

Attack Chain

An attacker gains unauthorized access to an Azure account, potentially through credential compromise or account takeover.
The attacker leverages the compromised account to authenticate to the Azure environment.
The attacker enumerates available Key Vault resources within the Azure subscription.
The attacker attempts to modify a Key Vault configuration, such as changing access policies, secrets, or encryption keys.
The modification is logged as an Azure Activity Log event with operation name MICROSOFT.KEYVAULT/VAULTS/* and event outcome of Success.
The "new terms" rule triggers because the user performing the modification (azure.activitylogs.identity.claims_initiated_by_user.name) is not a known user of Key Vaults, based on a 14-day history.
The attacker leverages the modified Key Vault configuration to access sensitive data or disrupt services.
The attacker may further attempt to cover their tracks by deleting audit logs or other evidence of their activity.

Impact

Unauthorized modifications to Azure Key Vault can have significant consequences, including data breaches, service disruptions, and compliance violations. The rule has a low severity and a risk score of 21. If an attacker successfully modifies a Key Vault, they could potentially access sensitive secrets and encryption keys, leading to the compromise of critical applications and data. This could affect multiple organizations that rely on the compromised Key Vault for securing their cloud infrastructure.

Recommendation

Deploy the Sigma rules provided in this brief to your SIEM to detect unusual Key Vault modifications.
Investigate any alerts generated by the Sigma rules, focusing on the user (azure.activitylogs.identity.claims_initiated_by_user.name), the Key Vault resource ID (azure.activitylogs.resource_id), and the type of modification (azure.activitylogs.operation_name).
Review Azure Key Vault access policies and ensure that only authorized users and applications have the necessary permissions.
Enable multi-factor authentication (MFA) for all Azure accounts, especially those with access to sensitive resources like Key Vaults.
Monitor Azure Activity Logs for any suspicious activity related to Key Vault modifications (Data Source: Azure Activity Logs).

Configuration-Audit - CraftedSignal Threat Feed

Zoom Meetings Created Without Passcodes

Attack Chain

Impact

Recommendation

Azure Key Vault Modified by Unusual User

Attack Chain

Impact

Recommendation