Graphapi - CraftedSignal Threat Feed

Azure AD Privileged Graph API Permission Assignment

hello@craftedsignal.io — Mon, 29 Jan 2024 12:00:00 +0000

This threat brief focuses on the assignment of privileged Graph API permissions within Azure Active Directory (Azure AD). Attackers, including groups like NOBELIUM, may attempt to assign themselves or compromised applications excessive permissions to maintain persistence, escalate privileges, or achieve other malicious objectives within the cloud environment. The permissions of concern are Application.ReadWrite.All, AppRoleAssignment.ReadWrite.All, and RoleManagement.ReadWrite.Directory, as these grant broad control over applications, role assignments, and directory settings. The detection leverages Azure AD audit logs specifically monitoring 'Update application' operations. Successful exploitation can lead to unauthorized modifications and potential security breaches, compromising the integrity and security of the Azure AD environment. This activity became particularly relevant after the Midnight Blizzard attack, highlighting the need for robust monitoring of Azure AD permission changes.

Attack Chain

An attacker gains initial access to an Azure AD account, possibly through credential theft or phishing.
The attacker authenticates to the Azure portal or uses the Azure CLI with the compromised account.
The attacker identifies an existing application registration within Azure AD that they can modify.
Using the compromised account, the attacker attempts to update the application registration.
The attacker assigns one or more of the following high-risk Graph API permissions to the application: Application.ReadWrite.All, AppRoleAssignment.ReadWrite.All, or RoleManagement.ReadWrite.Directory. This involves modifying the requiredAppPermissions property of the application object.
The Azure AD audit log records an "Update application" event with the modified requiredAppPermissions.
The attacker uses the application's newly acquired permissions to perform malicious actions, such as reading or modifying application configurations, role assignments, or directory settings.
The attacker maintains persistence by leveraging the application's elevated privileges for ongoing unauthorized access and control.

Impact

Successful assignment of these permissions can lead to a complete compromise of the Azure AD environment. An attacker can modify application configurations, create or delete users, assign roles, and potentially gain access to other connected resources and services. The impact can range from data breaches and service disruption to complete control over the organization's cloud identity infrastructure. This is a critical issue, especially in light of recent nation-state attacks targeting Azure AD, as highlighted by Microsoft's guidance on the Midnight Blizzard attack.

Recommendation

Deploy the provided Sigma rule Azure AD Privileged Graph API Permission Assigned to your SIEM, ensuring it is tuned to your environment, and enable the data source: azure_monitor_aad with category AuditLogs.
Investigate any alerts triggered by the Sigma rule Azure AD Privileged Graph API Permission Assigned immediately to determine if the permission assignment was authorized.
Review application registrations in Azure AD and identify any applications with excessive or unnecessary permissions.
Monitor Azure AD audit logs for any modifications to application registrations, focusing on changes to the requiredAppPermissions property.
Implement multi-factor authentication (MFA) for all user accounts, especially those with administrative privileges, to mitigate the risk of credential theft.

Microsoft Graph API Email Access by Unusual Client and User

hello@craftedsignal.io — Tue, 09 Jan 2024 18:00:00 +0000

This rule identifies access to email resources via Microsoft Graph API using a first-party application on behalf of a user principal, which may indicate an adversary using a phished OAuth refresh token or a Primary Refresh Token (PRT) to access email resources. This behavior can lead to unauthorized email access, data exfiltration, and business email compromise. The detection focuses on requests to Microsoft Graph API endpoints related to email, such as /me/mailFolders/inbox/messages or /users/{user_id}/messages, using a public client application ID and a user principal object ID. The rule uses a new_terms aggregation, only signaling if the application ID and user principal object ID combination have not been seen doing this activity in the last 14 days, reducing false positives from common or expected application usage. The detection logic incorporates activity from Microsoft Graph Activity Logs to identify anomalous email access patterns.

Attack Chain

Initial Access: The attacker gains access to a user's credentials, either through phishing, credential stuffing, or by compromising a Primary Refresh Token (PRT). (T1566, T1110)
Token Exploitation: The attacker uses the compromised OAuth refresh token or PRT to authenticate to the Microsoft Graph API.
Application Registration (Optional): The attacker might register a malicious application within Azure AD to facilitate access. (Not explicitly covered but a possibility.)
Graph API Interaction: The attacker makes requests to the Microsoft Graph API, specifically targeting email resources using email-related scopes such as Mail.Read, Mail.ReadWrite, or Mail.Send.
Email Access: The attacker accesses sensitive email data, potentially reading inbox contents, sending emails, or enumerating mail folders via the /me/mailFolders/inbox/messages or /users/{user_id}/messages endpoints. (T1114)
Data Exfiltration/Manipulation: The attacker exfiltrates sensitive information or manipulates email content for malicious purposes.
Persistence: The attacker maintains access by continuously using the compromised token or by establishing new persistence mechanisms.

Impact

A successful attack can lead to significant data breaches, financial losses, and reputational damage. Attackers can gain unauthorized access to sensitive email communications, intellectual property, and customer data. Business email compromise (BEC) is a likely outcome, enabling attackers to conduct fraudulent activities. The number of potential victims is vast, encompassing any organization using Microsoft 365 and relying on Azure Active Directory (Entra ID) for authentication.

Recommendation

Deploy the Sigma rule Unusual Graph API Email Access by Client and User to your SIEM to detect anomalous access patterns. Tune the rule by allowlisting known good app_id and user_principal_object_id combinations to reduce false positives.
Investigate any alerts generated by the Sigma rule by examining the azure.graphactivitylogs.properties.app_id, user.id, source.ip, and azure.graphactivitylogs.properties.scopes fields in the logs.
Implement Conditional Access policies to restrict OAuth consent and risky sign-ins, mitigating the initial access vector. Refer to the references for guidance.
Regularly audit and review application permissions within Azure AD to identify and remove any suspicious or overly permissive applications.
Monitor azure.auditlogs and azure.signinlogs for recent application grants and risky sign-ins occurring before or after email access.
Block known malicious applications by azure.graphactivitylogs.properties.app_id in your Azure AD tenant based on threat intelligence feeds.

Unusual Microsoft Graph Email Access via OAuth Application

hello@craftedsignal.io — Wed, 03 Jan 2024 10:00:00 +0000

This detection identifies potentially malicious access to email resources through the Microsoft Graph API. Attackers may leverage compromised OAuth refresh tokens or Primary Refresh Tokens (PRTs) to access sensitive email data. The activity is characterized by requests to Microsoft Graph API endpoints such as /me/mailFolders/inbox/messages or /users/{user_id}/messages, using a public client application ID on behalf of a user. The rule focuses on identifying novel combinations of application ID and user principal object ID accessing email resources within a 14-day timeframe, as this may indicate a compromised or newly deployed malicious application. This behavior could be related to campaigns similar to those observed by Volexity targeting Microsoft 365 OAuth workflows.

Attack Chain

The attacker compromises a user's credentials or obtains a valid OAuth refresh token or PRT through phishing or other means (T1566).
The attacker uses the compromised token to authenticate to the Microsoft Graph API via a custom or existing application.
The application requests access to email-related scopes such as Mail.Read, Mail.ReadWrite, or Mail.Send (T1550.001).
The application makes API calls to enumerate mail folders, read messages, or send emails on behalf of the compromised user (T1114.002).
The attacker may exfiltrate sensitive email content or use the compromised account to send phishing emails to other users (TA0009).
The unusual combination of application ID and user principal triggers a detection due to the novel access pattern.
The attacker persists by continuing to use the stolen token for ongoing access to email resources.

Impact

Successful exploitation can lead to unauthorized access to sensitive email data, potentially resulting in data breaches, financial loss, and reputational damage. The compromise of user accounts can also enable attackers to send phishing emails or conduct further malicious activities within the organization. If undetected, the attacker can maintain persistent access to email resources.

Recommendation

Deploy the Sigma rule Microsoft Graph Unusual App Email Access to detect novel app/user combinations accessing email data via Graph API, using logs-azure.graphactivitylogs-* as the index.
Investigate applications flagged by the rule by pivoting to Azure Portal -> Enterprise Applications and searching by the azure.graphactivitylogs.properties.app_id to determine app details, publisher, and consent status.
Review and restrict risky OAuth permissions in Conditional Access and App Governance policies, as mentioned in the triage steps within the rule's description.
Monitor for suspicious automation tools in the user_agent.original field within the logs-azure.graphactivitylogs-* index to identify potential scripted access.
Revoke the application's consent in Azure AD and revoke user refresh tokens via Microsoft Entra or PowerShell if unauthorized access is suspected.

Microsoft Graph API Request User Impersonation by Unusual Client

hello@craftedsignal.io — Tue, 02 Jan 2024 12:00:00 +0000

This detection identifies the initial use of a Microsoft Graph API request originating from a specific client application ID (azure.graphactivitylogs.properties.app_id) tied to a user principal object ID (azure.graphactivitylogs.properties.user_principal_object_id) and a tenant ID (azure.tenant_id). This activity may signify unauthorized access achieved through methods like phishing, stolen tokens, or exploitation of OAuth workflows. Threat actors may leverage legitimate Microsoft or third-party application IDs to evade suspicion while performing actions on behalf of compromised users. The rule focuses on identifying unusual combinations of these three identifiers within a defined timeframe to highlight potentially malicious activity that bypasses standard authentication alerts.

Attack Chain

The attacker compromises user credentials through phishing or other means (T1566).
The attacker obtains or steals a legitimate application access token (T1528).
The attacker uses the stolen access token to make authenticated requests to the Microsoft Graph API, impersonating the compromised user.
The attacker queries the Graph API for sensitive information such as user details, email, or files.
The attacker accesses and potentially downloads sensitive data through the Graph API.
The attacker leverages the compromised account to perform actions such as sending emails or creating resources.
The attacker maintains persistence by creating new OAuth applications or modifying existing ones.

Impact

Successful exploitation can lead to unauthorized access to sensitive data, including emails, files, and user information, within a Microsoft 365 environment. Attackers can leverage compromised accounts to perform malicious actions, such as sending phishing emails or creating new resources. The scope of impact depends on the permissions granted to the compromised application and the data accessible through the Graph API. Detecting the initial unusual use of a client ID helps in early identification before significant damage occurs.

Recommendation

Deploy the Sigma rule "Microsoft Graph Request User Impersonation by Unusual Client" to your SIEM and tune the history_window_start parameter to your environment needs.
Review azure.graphactivitylogs.properties.user_principal_object_id and correlate with recent sign-in logs for the associated user as mentioned in the rule's note section.
Inspect azure.graphactivitylogs.properties.scopes to understand the level of access being requested by the app, as suggested in the rule's note section.
Implement Conditional Access policies to restrict Graph API access based on app type, IP address, or device state as described in the rule's note section.
Monitor usage of new or uncommon app_id values across your tenant.