Ropc - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/ropc/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 17 Jan 2024 12:00:00 +0000Entra ID Unusual ROPC Login Attempthttps://feed.craftedsignal.io/briefs/2024-01-entra-id-ropc/Wed, 17 Jan 2024 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-entra-id-ropc/Detects unusual resource owner password credential (ROPC) login attempts by a user principal in Microsoft Entra ID, potentially indicating account compromise or password spraying.This detection identifies unusual Resource Owner Password Credentials (ROPC) login attempts within Microsoft Entra ID. ROPC is a legacy OAuth 2.0 flow where applications obtain tokens by directly providing user credentials, a method less secure than modern alternatives. Adversaries exploit ROPC to bypass multi-factor authentication (MFA) and gain unauthorized access to user accounts. The rule specifically focuses on detecting first-time ROPC usage by a user principal within a 10-day window, indicating potential enumeration, password spraying, or use of compromised credentials. Successful ROPC logins without MFA are a red flag. This activity is typically associated with account takeover attempts.

Attack Chain

  1. Initial Access: An attacker gains initial access by obtaining valid user credentials through phishing, password spraying, or credential stuffing.
  2. Bypass MFA: The attacker leverages the ROPC flow to bypass MFA, as ROPC does not inherently require or support it.
  3. Application Enumeration: The attacker uses tools like TeamFiltration or custom scripts to enumerate available applications and resources accessible with the compromised account.
  4. Token Acquisition: The attacker's application or script requests an access token from Entra ID using the compromised credentials and the ROPC grant type.
  5. Resource Access: With a valid access token, the attacker accesses sensitive resources such as Exchange Online, SharePoint, or Teams, depending on the permissions granted to the application and user.
  6. Lateral Movement: The attacker uses the initial access to move laterally within the Entra ID environment, targeting additional user accounts or resources.
  7. Data Exfiltration: The attacker exfiltrates sensitive data from accessed resources, such as emails, documents, or application data.

Impact

Successful exploitation allows attackers to gain unauthorized access to user accounts and sensitive resources within the Microsoft Entra ID environment. This can lead to data breaches, financial loss, and reputational damage. The ROPC flow, when abused, circumvents MFA protections, increasing the risk of successful account takeover. Organizations may experience data exfiltration, business email compromise, or disruption of cloud services.

Recommendation

  • Deploy the Sigma rule "Entra ID OAuth ROPC Grant Login Detected" to your SIEM and tune for your environment to identify unusual ROPC login attempts (see rule below).
  • Review the azure.signinlogs.properties.user_principal_name field from the logs to identify the users involved in ROPC login attempts.
  • Investigate the source of the ROPC login attempt, including the application (azure.signinlogs.properties.app_display_name) and IP address (azure.signinlogs.properties.client_ip) by enabling Azure Sign-In Logs.
  • Enforce multi-factor authentication (MFA) for all users and applications, and restrict the use of ROPC where possible.
  • Monitor for suspicious activity, such as unusual login locations or access to sensitive resources.
]]>mediumthreatazureentra-idropcinitial-access