Remediation and Hardening Strategies for Microsoft 365 to Defend Against UNC2452

Overview

Background

In December 2020, FireEye uncovered and publicly disclosed a widespread campaign conducted by the threat group we track as UNC2452. In some, but not all, of the intrusions associated with this campaign where Mandiant has visibility, the attacker used their access to on-premises networks to gain unauthorized access to the victim’s Microsoft 365 environment.

Goals and Objectives

UNC2452 and other threat actors have used several methodologies to move laterally from on-premises networks to the cloud, specifically Microsoft 365. This paper will help organizations understand these techniques used by UNC2452, how to proactively harden their environments, and how to remediate environments where similar techniques have been observed.

It is important to note that there is no formal security boundary between on-premises networks and cloud services provided by Microsoft 365. If an organization discovers evidence of targeted threat actor activity in their on-premises network, a thorough review of the cloud environment is often necessary as well.

Organizations can use the Azure AD Investigator auditing script, available from the FireEye GitHub repository, to check their Microsoft 365 tenants for indicators relative to the techniques detailed throughout this paper. The script will alert administrators and security practitioners to artifacts that may require further review to determine if they are truly malicious or part of legitimate activity.

Attacker Tactics, Techniques and Procedures (TTPs)

Mandiant has observed UNC2452 and other threat actors moving laterally to the Microsoft 365 cloud using a combination of four primary techniques:

1. Steal the Active Directory Federation Services (AD FS) token-signing certificate and use it to forge tokens for arbitrary users (sometimes described as Golden SAML). This would allow the attacker to authenticate into a federated resource provider (such as Microsoft 365) as any user, without the need for that user’s password or their corresponding multi-factor authentication (MFA) mechanism.
2. Modify or add trusted domains in Azure AD to add a new federated Identity provider (IdP) that the attacker controls. This would allow the attacker to forge tokens for arbitrary users and has been described as an Azure AD backdoor.
3. Compromise the credentials of on-premises user accounts that are synchronized to Microsoft 365 and are assigned high privileged directory roles, such as Global Administrator or Application Administrator.
4. Hijack an existing Microsoft 365 application by adding a rogue credential to it in order to use the legitimate permissions assigned to the application, such as the ability to read email, send email as an arbitrary user, access user calendars, etc., while bypassing MFA.

Download whitepaper to find more.