https://feed.craftedsignal.io/tags/remote-employment-fraud/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 03 Jan 2024 15:30:00 +0000https://feed.craftedsignal.io/briefs/2024-01-03-zoom-high-video-latency/Wed, 03 Jan 2024 15:30:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-03-zoom-high-video-latency/This analytic identifies Zoom users exhibiting high video latency, a potential indicator of Remote Employment Fraud (REF), by analyzing Zoom logs for average and overall latency and highlighting users with latency exceeding 300ms.This detection focuses on identifying Zoom users exhibiting unusually high video latency, which can be an indicator of Remote Employment Fraud (REF). Threat actors engaged in REF often operate from locations with suboptimal network infrastructure or utilize network manipulation techniques that result in elevated latency. The detection analyzes Zoom logs to identify users whose video streams exhibit an average latency exceeding 300ms, a threshold that, while potentially indicative of a simple network issue, when combined with other indicators, may suggest fraudulent activity. The detection leverages Zoom logs ingested using Splunk Connect for Zoom. Initial version was released on 2026-04-15.

Attack Chain

1. Attacker gains unauthorized access to a legitimate employee's Zoom account or creates a fraudulent account.
2. The attacker initiates a Zoom meeting or joins an existing meeting.
3. During the meeting, the attacker may be using a compromised or remote machine with a high-latency network connection.
4. Zoom logs record the high video latency associated with the attacker's account, specifically in the payload.object.participant.qos{}.details.avg_latency field.
5. The Splunk detection identifies the high latency event, flagging the associated email address.
6. Analysts investigate the flagged user, correlating the high latency with other suspicious activities.
7. Risk scoring increases for the user account based on high video latency.
8. If REF is confirmed, the compromised account is terminated, and access is revoked.

Impact

Successful REF can lead to financial losses, data breaches, and reputational damage for organizations. Although high latency alone is not definitive evidence of REF, it serves as a valuable indicator when correlated with other suspicious activities. This detection helps security teams identify potentially compromised accounts and prevent further fraudulent activities. The number of potential victims is dependent on the number of compromised accounts within the organization.

Recommendation

• Deploy the Sigma rule Detect Zoom High Video Latency to your SIEM to identify potentially fraudulent accounts based on high video latency.
• Enable Zoom logging and ingest logs using Splunk Connect for Zoom (https://splunkbase.splunk.com/app/4961) to ensure the availability of necessary data for this detection.
• Tune the latency threshold in the Sigma rule (overall_latency>300) to align with your environment baseline and reduce false positives.
• Investigate any alerts generated by this detection and correlate them with other security events to identify potential Remote Employment Fraud.

]]>mediumadvisoryremote-employment-fraudzoomidentityhttps://feed.craftedsignal.io/briefs/2024-01-03-geographic-improbable-location/Wed, 03 Jan 2024 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-03-geographic-improbable-location/Detection of user logins originating from geographically distant locations within a short timeframe, indicative of potential Remote Employment Fraud or compromised credentials.This detection identifies "improbable travel" scenarios where a user logs in from two geographically distant locations within a short timeframe, suggesting potential Remote Employment Fraud (REF) or compromised credentials. The analysis focuses on login events for critical applications like Workday, Slack, GlobalProtect, Jira, Atlassian Cloud, and Zoom, using Okta logs as a primary data source. This technique is relevant because REF actors and credential thieves often operate from different locations than the legitimate user, and time zone/geographic inconsistencies can expose fraudulent activity. The detection considers factors like user's work country, travel speed, and distance between login locations to assess the risk. This helps defenders identify suspicious logins that bypass traditional security measures.

Attack Chain

1. User credentials compromised via phishing or other methods (not directly observed in this detection, but a common precursor).
2. Attacker establishes initial access from Location A, authenticating to a target application (e.g., Workday) via Okta.
3. A short time later (minutes to hours), the attacker attempts to access the same or a different application from Location B, potentially on the other side of the world.
4. The detection analyzes Okta logs and correlates login events based on the user ID, source IP, and timestamp.
5. Geolocation data (latitude, longitude) is obtained for both login locations based on the source IP addresses.
6. The distance and travel speed between the two locations are calculated.
7. If the calculated speed exceeds a defined threshold (e.g., 500 km/h) and distance exceeds a defined threshold (e.g., 750 km), the activity is flagged as suspicious.
8. The user's work country is compared to the login locations to further assess the risk. If the login locations do not match the user's expected work location, the risk score is increased.

Impact

Successful exploitation of this technique can lead to unauthorized access to sensitive corporate resources, data exfiltration, and financial fraud. Compromised accounts used for Remote Employment Fraud can result in financial losses and reputational damage. While the exact number of victims and sectors targeted are not explicitly mentioned in the source, this type of attack can affect organizations of any size in any sector. A successful attack can result in significant financial losses and legal liabilities.

Recommendation

• Deploy the Sigma rule Geographic Improbable Location to your SIEM, ensuring it is tuned to account for legitimate VPN usage and remote work scenarios.
• Investigate any alerts generated by the Geographic Improbable Location rule, focusing on users with high-value accounts and access to sensitive data.
• Utilize the known_devices_public_ip_filter.csv lookup table (mentioned in the "how_to_implement" section) to exclude known and trusted devices from the detection logic.
• Monitor Okta logs for failed login attempts preceding improbable travel events to identify potential credential compromise attempts.
• Implement multi-factor authentication (MFA) for all users to reduce the risk of credential compromise.

]]>highadvisoryremote-employment-fraudcredential-compromiseokta