FireEye publicly disclosed an attacker campaign which is tracked as UNC2452 in December. In some of the intrusions, where Mandiant, a portfolio of cybersecurity solutions, has visibility, the attackers used to access on-premises networks to gain unauthorized access to Microsoft 365 environment. Methodologies used by the attackers are explained in detail in FireEye’s Remediation and Hardening Strategies for Microsoft 365 to Defend Against UNC2452 white paper. It also helps organizations to harden the environment and remediate environments.
Azure AD Investigator
Mandiant is also releasing Azure AD Investigator, an auditing script, through its GitHub repository. It allows organizations to check their Microsoft 365 tenants for indicators of some of the techniques used by UNC2452. The auditing script alerts users to artifacts that may require further review to determine if they are malicious or part of legitimate activity.
According to the announcement, the techniques explained in the white paper are dual-use. This means they can be used by threat actors but also by legitimate tools. Thus, a detailed review for specific configuration parameters may be warranted, including correlating and verifying that configurations are aligned with authorized and expected activities.
Mandiant has observed UNC2452 and other threat actors moving laterally to the Microsoft 365 cloud using a combination of four primary techniques:
- Steal the Active Directory Federation Services (AD FS) token-signing certificate and use it to forge tokens for arbitrary users (sometimes described as Golden SAML). This would allow the attacker to authenticate into a federated resource provider (such as Microsoft 365) as any user, without the need for that user’s password or their corresponding multi-factor authentication (MFA) mechanism.
- Modify or add trusted domains in Azure AD to add a new federated Identity Provider (IdP) that the attacker controls. This would allow the attacker to forge tokens for arbitrary users and has been described as an Azure AD backdoor.
- Compromise the credentials of on-premises user accounts that are synchronized to Microsoft 365 that have high privileged directory roles, such as Global Administrator or Application Administrator.
- Backdoor an existing Microsoft 365 application by adding a new application or service principal credential in order to use the legitimate permissions assigned to the application, such as the ability to read email, send email as an arbitrary user, access user calendars, etc.