https://feed.craftedsignal.io/vendors/cyberark/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 03 Jan 2024 16:00:00 +0000https://feed.craftedsignal.io/briefs/2024-01-cyberark-pas-error-audit-event-promotion/Wed, 03 Jan 2024 16:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-cyberark-pas-error-audit-event-promotion/This rule identifies CyberArk Privileged Access Security (PAS) error level audit events, which are considered alertable events by the vendor and may indicate privilege escalation or initial access attempts.This detection identifies error-level audit events within CyberArk Privileged Access Security (PAS), which are designated by the vendor as alertable. These events are crucial for monitoring the security posture of privileged accounts and the overall CyberArk environment. The rule is designed to promote visibility of critical security incidents, particularly those related to privilege escalation and potential initial access attempts. It relies on data ingested through the CyberArk PAS Fleet integration, Filebeat module, or a similarly structured data source. By focusing on error events, security teams can efficiently prioritize investigations into potentially malicious activities affecting their most sensitive accounts and systems.

Attack Chain

1. Attacker gains initial access to a system with credentials that have limited privileges.
2. The attacker attempts to access a restricted resource or perform an action that requires higher privileges within the CyberArk environment.
3. CyberArk PAS detects the unauthorized attempt based on its configured policies.
4. CyberArk PAS generates an error-level audit event, logging the failed attempt with a specific event code.
5. The security monitoring system ingests this error event.
6. This detection triggers based on the error-level audit event.
7. Security analysts investigate the event to determine the nature and scope of the unauthorized activity.
8. Based on the investigation findings, appropriate remediation steps are taken, such as revoking compromised credentials or strengthening access controls.

Impact

A successful privilege escalation attack can allow an attacker to gain complete control over critical systems and data within the CyberArk PAS environment. This can lead to data breaches, system outages, and significant financial losses. Initial access via compromised credentials, combined with privilege escalation attempts, poses a serious threat to the entire organization. By detecting these error events, organizations can significantly reduce the risk of a successful attack.

Recommendation

• Deploy the Sigma rule CyberArk PAS Error Event to your SIEM to detect error-level events in CyberArk PAS audit logs.
• Tune the CyberArk PAS Error Event rule to exclude any event.code values that are known false positives in your environment, as described in the rule's false_positives field.
• Ensure that the CyberArk PAS Fleet integration or Filebeat module is properly configured to collect and forward audit logs to your SIEM (see "Setup" section).
• Investigate all triggered alerts from the CyberArk PAS Error Event rule to determine the cause and impact of the error event.
• Consult the CyberArk documentation to understand the specific meaning and implications of each event.code that triggers an alert (see references).

]]>highadvisorycyberarkpasprivilege-escalationinitial-accesshttps://feed.craftedsignal.io/briefs/2024-01-cyberark-pas-recommended-monitor/Tue, 02 Jan 2024 10:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-cyberark-pas-recommended-monitor/This rule identifies CyberArk Privileged Access Security (PAS) events recommended for monitoring, focusing on non-error level audit events to detect potential privilege escalation, initial access, credential access, and persistence activities.This detection focuses on identifying noteworthy events within CyberArk Privileged Access Security (PAS) environments. CyberArk PAS is a critical component for managing and securing privileged accounts, and monitoring its audit logs is essential for detecting malicious activities. This rule specifically targets a set of non-error level audit events recommended by CyberArk for proactive monitoring, as outlined in their official documentation. By focusing on these specific events, security teams can gain enhanced visibility into potential privilege escalation attempts, unauthorized access, credential compromise, and persistence mechanisms employed by attackers targeting privileged accounts. The rule leverages event codes correlated to the CyberArk Vault Audit Action Codes to identify suspicious activities.

Attack Chain

1. An attacker gains initial access to a system with existing CyberArk PAS credentials (T1078).
2. The attacker attempts to access the CyberArk Vault using valid credentials.
3. The attacker performs actions that trigger monitored CyberArk audit events (e.g., password retrieval, account creation, policy changes) based on specific event codes like 4, 22, 24, etc..
4. The CyberArk PAS system logs these actions as audit events, recording the user, timestamp, and action performed.
5. The attacker attempts to elevate privileges by modifying account settings or policies (T1098).
6. The attacker attempts to retrieve stored credentials or secrets (T1555).
7. The system logs successful, but suspicious, privileged actions.
8. The attacker uses the elevated privileges to move laterally, access sensitive data, or establish persistence.

Impact

Compromise of CyberArk PAS can lead to widespread damage, as attackers gain control over privileged accounts. Successful attacks can result in unauthorized access to critical systems, data breaches, service disruption, and the installation of persistent backdoors. The potential impact includes significant financial losses, reputational damage, and regulatory fines.

Recommendation

• Deploy the Sigma rule CyberArk PAS Recommended Monitor to your SIEM to detect suspicious CyberArk PAS events. Tune the rule by excluding known benign event.code values to reduce false positives.
• Enable CyberArk PAS audit logging and ensure logs are being ingested into your SIEM (reference index field).
• Consult the CyberArk Vault Audit Action Codes documentation (linked in references) to understand the context and implications of triggered events.
• Investigate any alerts generated by the Sigma rule to determine the legitimacy of the activity and take appropriate remediation steps.
• Review and update CyberArk PAS security policies to minimize the risk of privilege escalation and unauthorized access.
• Monitor event.action values for any unusual or unexpected activity (reference rule_name_override field).

]]>highadvisorycyberarkpasprivilege-escalationinitial-accesscredential-accesspersistence