[FireEye]Remediation and Hardening Strategies for Microsoft 365 to Defend Against UNC2452

[igor51]

Remediation and Hardening Strategies for Microsoft 365 to Defend Against UNC2452

  UPDATE (Mar. 18): Mandiant recently observed targeted threat actors
    modifying mailbox folder permissions of user mailboxes to maintain
    persistent access to the targeted users' email messages. This
    stealthy technique is not usually monitored by defenders and
    provides threat actors a way to access the desired email messages
    using any compromised credentials. The white paper, blog post and
    Azure AD Investigator tool have been updated to reflect these
    findings. Mandiant would like to thank the members of Microsoft’s
    Detection and Response Team (DART) for their collaboration on this research.

 

In December 2020, FireEye uncovered and publicly disclosed a
  widespread attacker campaign that is being tracked as   href="/content/fireeye-www/en_US/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html">UNC2452.
  In some, but not all, of the intrusions associated with this campaign
  where Mandiant has visibility, the attacker used their access to
  on-premises networks to gain unauthorized access to the victim’s
  Microsoft 365 environment.

 

Goals and Objectives

 

Methodologies that UNC2452 and other threat actors have used to move
  laterally from on-premises networks to the Microsoft 365 cloud have
  been detailed in our white paper,
          target="_blank">Remediation and Hardening Strategies for Microsoft
      365 to Defend Against UNC2452. The paper also discusses
  how organizations can proactively harden their environments and
  remediate environments where similar techniques have been observed.

 

Mandiant is releasing an auditing script,     href="https://github.com/fireeye/Mandiant-Azure-AD-Investigator">Azure
    AD Investigator, through its GitHub repository that
  organizations can use to check their Microsoft 365 tenants for
  indicators of some of the techniques used by UNC2452. The script will
  alert administrators and security practitioners to artifacts that may
  require further review to determine if they are truly malicious or
  part of legitimate activity. Many of the attacker techniques detailed
  in the white paper are dual-use in nature—they can be used by threat
  actors but also by legitimate tools. Therefore, a detailed review for
  specific configuration parameters may be warranted, including
  correlating and verifying that configurations are aligned with
  authorized and expected activities.

 

Attacker Tactics, Techniques and Procedures (TTPs)

 

Mandiant has observed UNC2452 and other threat actors moving
  laterally to the Microsoft 365 cloud using a combination of four
  primary techniques:

 

1. Steal the Active Directory Federation Services (AD FS)
       token-signing certificate and use it to forge tokens for arbitrary
       users (sometimes described as       href="https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps">Golden
       SAML). This would allow the attacker to authenticate into a
       federated resource provider (such as Microsoft 365) as any user,
       without the need for that user’s password or their corresponding
       multi-factor authentication (MFA) mechanism.
2. Modify or add
       trusted domains in Azure AD to add a new federated Identity Provider
       (IdP) that the attacker controls. This would allow the attacker to
       forge tokens for arbitrary users and has been described as an       href="https://o365blog.com/post/aadbackdoor/">Azure AD   href="/content/fireeye-www/en_US/blog/threat-research/2020/09/detecting-microsoft-365-azure-active-directory-backdoors.html">backdoor.

   
3. Compromise the credentials of on-premises user accounts that are
       synchronized to Microsoft 365 that have high privileged directory
       roles, such as Global Administrator or Application
     Administrator.
4. 
           href="https://dirkjanm.io/azure-ad-privilege-escalation-application-admin/">Backdoor
       an existing Microsoft 365 application by adding a new application or
       service principal credential in order to use the legitimate
       permissions assigned to the application, such as the ability to read
       email, send email as an arbitrary user, access user calendars,
     etc.
5. Modify the permissions of folders in a victim mailbox
       (such as the inbox) to make its contents readable by any other user
       in the victim’s Microsoft 365 environment.

 

Read the     target="_blank">white paper for a detailed overview of each
  technique, including practical remediation and hardening strategies,
  and check out our auditing script,     href="https://github.com/fireeye/Mandiant-Azure-AD-Investigator">Azure
    AD Investigator.  

 

Detections

 
   
     
   
     
   
     
   
     
   
     
   
     
   
     
   
     

FireEye Helix Detection	MITRE Technique	Detection Logic
MICROSOFT AZURE ACTIVE DIRECTORY           [Risky Sign-In]	href="https://attack.mitre.org/techniques/T1078/004/">T1078.004	Alert on suspicious logon           activity as detected by Azure Identity Protection
OFFICE 365 [Federated Domain         Set]	href="https://attack.mitre.org/techniques/T1550/">T1550	Alert on new domain           federation in Office 365
OFFICE 365 [Modified Domain           Federation Settings]	href="https://attack.mitre.org/techniques/T1550/">T1550	Alert of modification to           domain federations settings in Office 365
OFFICE 365 [User Added Credentials           to Service Principal]	href="https://attack.mitre.org/techniques/T1098/001/">T1098.011	Alert on addition of           certificates or passwords added to Service Principals
OFFICE 365 ANALYTICS [Abnormal         Logon]	href="https://attack.mitre.org/techniques/T1078/004/">T1078.004	Alert on suspicious login           activity based on heuristics
WINDOWS METHODOLOGY [ADFS         Dump]	href="https://attack.mitre.org/tactics/TA0006/">TA0006                   href="https://attack.mitre.org/techniques/T1552/">T1552                   href="https://attack.mitre.org/techniques/T1552/004/">T1552.004                   href="https://attack.mitre.org/techniques/T1199/">T1199	Alert on activity access           requests for the AD FS Distributed Key Manager (DKM) container           in Active Directory
OFFICE 365 [Mailbox Folder Permission Change – Inbox and           Top Of Information Store]	href="https://attack.mitre.org/techniques/T1098/002/">T1098.002	Alert on suspicious modifications of mailbox folder           permissions for the inbox or top of information store.

Source: Remediation and Hardening Strategies for Microsoft 365 to Defend Against UNC2452