Frame-14

Privacy Ninja

        • DATA PROTECTION

        • Email Spoofing Prevention
        • Check if your organization email is vulnerable to hackers and put a stop to it. Receive your free test today!
        • Email Phishing Excercise
        • Strengthen your defense against email threats via simulated attacks that test and educate your team on spotting malicious emails, reducing breach risks and boosting security.

        • AntiHACK Phone
        • Boost your smartphone’s security with enterprise-level encryption, designed by digital forensics and counterintelligence experts, guaranteeing absolute privacy for you and up to 31 others, plus a guest user, through exclusive access.

        • CYBERSECURITY

        • Secure your network against various threat points. VA starts at only S$1,000, while VAPT starts at S$3,000. With Price Beat Guarantee!

        • API Penetration Testing
        • Secure your digital frontiers with our API penetration testing service, meticulously designed to identify and fortify vulnerabilities, ensuring robust protection against cyber threats.

        • Network Penetration Testing
        • Strengthen your network’s defenses with our comprehensive penetration testing service, tailored to uncover and seal security gaps, safeguarding your infrastructure from cyber attacks.

        • Mobile Penetration Testing
        • Strengthen your network’s defenses with our comprehensive penetration testing service, tailored to uncover and seal security gaps, safeguarding your infrastructure from cyber attacks.

        • Web Penetration Testing
        • Fortify your web presence with our specialized web penetration testing service, designed to uncover and address vulnerabilities, ensuring your website stands resilient against online threats.

        • RAPID DIGITALISATION

        • OTHERS

CISA Releases Azure, Microsoft 365 Malicious Activity Detection Tool

CISA Releases Azure, Microsoft 365 Malicious Activity Detection Tool

The Cybersecurity and Infrastructure Security Agency (CISA) has released a PowerShell-based tool that helps detect potentially compromised applications and accounts in Azure/Microsoft 365 environments.

This comes after Microsoft disclosed how stolen credentials and access tokens are actively being used by threat actors to target Azure customers.

Azure administrators are strongly recommended to review both these articles to learn more about these attacks and to discover how to spot anomalous behavior in their tenants.

“CISA has created a free tool for detecting unusual and potentially malicious activity that threatens users and applications in an Azure/Microsoft O365 environment,” the US federal agency said.

“The tool is intended for use by incident responders and is narrowly focused on activity that is endemic to the recent identity- and authentication-based attacks seen in multiple sectors.”

How CISA’s tool works

The PowerShell-based tool created by CISA’s Cloud Forensics team and dubbed Sparrow can be used to narrow down larger sets of investigation modules and telemetry “to those specific to recent attacks on federated identity sources and applications.”

Also Read: Computer Misuse Act Singapore: The Truth And Its Offenses

Sparrow checks the unified Azure/M365 audit log for indicators of compromise (IoCs), lists Azure AD domains, and checks Azure service principals and their Microsoft Graph API permissions to discover potential malicious activity.

The full list of checks it does once launched on the analysis machine includes:

  • Searches for any modifications to the domain and federation settings on a tenant’s domain
  • Searches for any modifications or credential modifications to an application
  • Searches for any modifications or credential modifications to a service principal
  • Searches for any app role assignments to service principals, users, and groups
  • Searches for any OAuth or application consents
  • Searches for SAML token usage anomaly (UserAuthenticationValue of 16457) in the Unified Audit Logs
  • Searches for PowerShell logins into mailboxes
  • Searches for well-known AppID for Exchange Online PowerShell
  • Searches for well-known AppID for PowerShell
  • Searches for the AppID to see if it accessed mail items
  • Searches for the AppID to see if it accessed Sharepoint or OneDrive items
  • Searches for WinRM useragent string in the user logged in and user login failed operations

Free Azure security tool also released by CrowdStrike

Cybersecurity firm CrowdStrike released a similar detection tool after investigating a failed hack following a warning received from Microsoft of a compromised Microsoft Azure reseller’s account having attempted to read the company’s emails using compromised Azure credentials.

After analyzing internal and production environments following the SolarWinds breach, CrowdStrike said last week it found no evidence of being impacted in the supply chain attack.

However, a second investigation was started following Microsoft’s alert that came while Crowdstrike was looking for IOCs associated with the SolarWinds hackers in their environment.

After analyzing their Azure environment and finding no evidence of compromise, Crowdstrike also found that Azure’s administrative tools were “particularly challenging” to use.

Also Read: Personal Data Websites: 3 Things That You Must Be Informed

To help admins analyze their Azure environments and get an easier overview of what privileges are assigned to third-party resellers and partners, CrowdStrike released the free CrowdStrike Reporting Tool for Azure (CRT) tool.

0 Comments

KEEP IN TOUCH

Subscribe to our mailing list to get free tips on Data Protection and Data Privacy updates weekly!

Personal Data Protection

REPORTING DATA BREACH TO PDPC?

We have assisted numerous companies to prepare proper and accurate reports to PDPC to minimise financial penalties.
×

Hello!

Click one of our contacts below to chat on WhatsApp

× Chat with us