How to Successfully Block Attacks with Valid Accounts

About the job

Who doesn’t know them? Emails from well-known companies such as SBB or Swisscom asking to reset the account password because there is apparently a security risk. And let’s be honest, who has never at least been tempted to click on the links, as these emails are now really well made and it is becoming increasingly difficult to simply recognise such fake emails? AI sends its regards. Thanks to advanced mail security solutions, most are fortunately intercepted, but some emails still slip through the net.

The trade in access information is booming
We are talking about phishing aimed at obtaining valid credentials. One might argue: Well, what does it matter to me as the IT security of my company if Freddi’s SBB credentials are stolen? Well, humans are known to be rather lazy and comfortable. Unfortunately, this often also applies to the choice of passwords for the many different accounts one accumulates over the course of (professional) life. So Freddi’s SBB account password could be the same as the password for his Tinder profile or for the company access.

Access brokers on a growth path
Enter: Access brokers. These are cybercriminals who obtain valid accounts and/or sell them on the dark web. And as is usual in the market economy, success naturally promotes growth. This also applies to the crooked dealings of criminals. CrowdStrike provided interesting figures in their current Global Threat Report 2024 regarding the increase in advertised accesses in 2023:
Source: CrowdStrike Global Threat Report 2024
Compared to the figures from 2022, this represents an increase of around 20%. Freddi would therefore be well advised to use a unique password for each of his services. Password managers – your friend and helper.

Identity-based attacks are becoming more sophisticated
Because 2FA, or MFA, or whatever you want to call it, is becoming more widespread, attackers naturally have to adapt accordingly. Security analysts therefore see an increase in attacks aimed at obtaining API keys, session cookies and tokens, one-time passwords (OTP) or Kerberos tickets. In the MITRE ATT&CK Framework, this is the tactic "Credential Access". OTPs are thus unfortunately not a panacea in this context. For example, SMS is still often used as a second factor and can be intercepted via SIM swapping. For OTPs, such as those from the widely used Microsoft Authenticator, human tendency to act thoughtlessly plays a crucial role. Can we be sure that Freddi does not simply press "Approve" when prompted by Microsoft Authenticator, even though he has not logged in anywhere himself? Sometimes "a bit of thinking" is quite a lot to ask.

IT hygiene
As with humans, good hygiene in IT also protects against all sorts of unpleasant and unwanted things. So additional products are not always necessarily required. I will now venture to say that the cyber resilience of most companies could be noticeably improved by reducing the attack surface of Microsoft’s Active Directory by closing known security gaps and configuration oversights. The same applies to hardening Windows clients and servers. The undeniable challenge here, however, is finding these oversights and gaps. And this is where supporting products often come into play again.

CrowdStrike offers a convenient and clear way to increase the security of Active Directory as part of the "Identity Protection" module. The identified risks are sorted according to a risk matrix, which allows easy prioritisation. In addition, mitigation guidance is provided for each risk.
Source: CrowdStrike Identity Protection – Domain Security Overview

Protecting identities
The idea behind CrowdStrike’s "Identity Protection" is actually not new. So-called "User and Entity Behaviour Analytics" (UEBA) solutions have been available from various vendors for some time. "Identity Protection" ultimately falls into this category. Essentially, it is about creating a "behaviour baseline" for all "users", i.e. determining what is considered normal in order to then detect the abnormal. The same applies to "entities", which means everything else that communicates on the network. When suspicious anomalies are detected, the security team is informed, allowing for quick analysis and targeted responses. Corresponding workflows can also automate responses to detections.

Returning to Freddi and his lost password, we have a possible use case: It is in the nature of stolen credentials that they sooner or later end up in credential dumps, which can then be tapped from various sources. One of the better-known sources is "haveibeenpwned". CrowdStrike uses this service to check whether passwords used in the AD are found in credential dumps. If so, there is a corresponding detection that can be responded to manually or automatically. One possible automatic response is, for example, to prevent Freddi from logging in with his compromised password and instead force a password change. Alternatively or additionally, custom password lists with unwanted passwords can be stored.

If we already have baselines and thus know which user normally works with which systems, we can also use this information for further use cases. In the following example, authentication requests originating from unusual endpoints are secured by an additional "identity verification". This means the affected user is asked to verify the login via a triggered MFA.
Source: CrowdStrike Identity Protection – Enforcement Rule

Conclusion
Looking at the general trend towards attacks with valid accounts, one inevitably comes to the conclusion that there is really no way around specifically protecting identities. Figures from OverWatch, CrowdStrike’s threat hunting division, speak of 8 out of 10 successful attacks using compromised accounts. It is made more difficult by the fact that attacks often do not even originate from one’s own devices but from hosts of external suppliers or service providers. Without a focus on identities, such attacks remain completely undetected until it may be too late. In my opinion, CrowdStrike’s Identity Protection offers a very powerful tool that should not be missing in any modern toolkit.

PS: Should any real Freddis feel addressed, rest assured that any similarities are purely coincidental.

Further links
www.avantec.ch/loesungen/crowdstrike
The article How to Successfully Block Attacks with Valid Accounts first appeared on Tec-Bite.