Remediation and Hardening Strategies for Microsoft 365 to Defend Against UNC2452
UPDATE (Mar. 18): Mandiant recently observed targeted threat actors
modifying mailbox folder permissions of user mailboxes to maintain
persistent access to the targeted users' email messages. This
stealthy technique is not usually monitored by defenders and
provides threat actors a way to access the desired email messages
using any compromised credentials. The white paper, blog post and
Azure AD Investigator tool have been updated to reflect these
findings. Mandiant would like to thank the members of Microsoft’s
Detection and Response Team (DART) for their collaboration on this research.
In December 2020, FireEye uncovered and publicly disclosed a
widespread attacker campaign that is being tracked as href="/content/fireeye-www/en_US/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html">UNC2452.
In some, but not all, of the intrusions associated with this campaign
where Mandiant has visibility, the attacker used their access to
on-premises networks to gain unauthorized access to the victim’s
Microsoft 365 environment.
Goals and Objectives
Methodologies that UNC2452 and other threat actors have used to move
laterally from on-premises networks to the Microsoft 365 cloud have
been detailed in our white paper,
target="_blank">Remediation and Hardening Strategies for Microsoft
365 to Defend Against UNC2452. The paper also discusses
how organizations can proactively harden their environments and
remediate environments where similar techniques have been observed.
Mandiant is releasing an auditing script, href="https://github.com/fireeye/Mandiant-Azure-AD-Investigator">Azure
AD Investigator, through its GitHub repository that
organizations can use to check their Microsoft 365 tenants for
indicators of some of the techniques used by UNC2452. The script will
alert administrators and security practitioners to artifacts that may
require further review to determine if they are truly malicious or
part of legitimate activity. Many of the attacker techniques detailed
in the white paper are dual-use in nature—they can be used by threat
actors but also by legitimate tools. Therefore, a detailed review for
specific configuration parameters may be warranted, including
correlating and verifying that configurations are aligned with
authorized and expected activities.
Attacker Tactics, Techniques and Procedures (TTPs)
Mandiant has observed UNC2452 and other threat actors moving
laterally to the Microsoft 365 cloud using a combination of four
primary techniques:
- Steal the Active Directory Federation Services (AD FS)
token-signing certificate and use it to forge tokens for arbitrary
users (sometimes described as href="https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps">Golden
SAML). This would allow the attacker to authenticate into a
federated resource provider (such as Microsoft 365) as any user,
without the need for that user’s password or their corresponding
multi-factor authentication (MFA) mechanism. - Modify or add
trusted domains in Azure AD to add a new federated Identity Provider
(IdP) that the attacker controls. This would allow the attacker to
forge tokens for arbitrary users and has been described as an href="https://o365blog.com/post/aadbackdoor/">Azure AD href="/content/fireeye-www/en_US/blog/threat-research/2020/09/detecting-microsoft-365-azure-active-directory-backdoors.html">backdoor.
- Compromise the credentials of on-premises user accounts that are
synchronized to Microsoft 365 that have high privileged directory
roles, such as Global Administrator or Application
Administrator.
href="https://dirkjanm.io/azure-ad-privilege-escalation-application-admin/">Backdoor
an existing Microsoft 365 application by adding a new application or
service principal credential in order to use the legitimate
permissions assigned to the application, such as the ability to read
email, send email as an arbitrary user, access user calendars,
etc.- Modify the permissions of folders in a victim mailbox
(such as the inbox) to make its contents readable by any other user
in the victim’s Microsoft 365 environment.
Read the target="_blank">white paper for a detailed overview of each
technique, including practical remediation and hardening strategies,
and check out our auditing script, href="https://github.com/fireeye/Mandiant-Azure-AD-Investigator">Azure
AD Investigator.
Detections
FireEye Helix Detection
|
MITRE Technique
|
Detection Logic
|
MICROSOFT AZURE ACTIVE DIRECTORY
[Risky Sign-In] |
href="https://attack.mitre.org/techniques/T1078/004/">T1078.004
| Alert on suspicious logon
activity as detected by Azure Identity Protection |
OFFICE 365 [Federated Domain
Set] |
href="https://attack.mitre.org/techniques/T1550/">T1550
| Alert on new domain
federation in Office 365 |
OFFICE 365 [Modified Domain
Federation Settings] |
href="https://attack.mitre.org/techniques/T1550/">T1550
| Alert of modification to
domain federations settings in Office 365 |
OFFICE 365 [User Added Credentials
to Service Principal] |
href="https://attack.mitre.org/techniques/T1098/001/">T1098.011
| Alert on addition of
certificates or passwords added to Service Principals
|
OFFICE 365 ANALYTICS [Abnormal
Logon] |
href="https://attack.mitre.org/techniques/T1078/004/">T1078.004
| Alert on suspicious login
activity based on heuristics |
WINDOWS METHODOLOGY [ADFS
Dump] |
href="https://attack.mitre.org/tactics/TA0006/">TA0006
href="https://attack.mitre.org/techniques/T1552/">T1552
href="https://attack.mitre.org/techniques/T1552/004/">T1552.004
href="https://attack.mitre.org/techniques/T1199/">T1199
| Alert on activity access
requests for the AD FS Distributed Key Manager (DKM) container
in Active Directory |
OFFICE 365 [Mailbox Folder Permission Change – Inbox and
Top Of Information Store] |
href="https://attack.mitre.org/techniques/T1098/002/">T1098.002
| Alert on suspicious modifications of mailbox folder
permissions for the inbox or top of information store.
|
Source: Remediation and Hardening Strategies for Microsoft 365 to Defend Against UNC2452 (http://)