Enterprise Cybersecurity https://docs.microsoft.com/archive/blogs/jonathantrull/feed.xml Aligning Strategy and Technology to Reduce Risk from Cyber Threats Wed, 17 Apr 2019 03:47:09 GMT en-US hourly 1 Disrupting the Kill Chain https://docs.microsoft.com/archive/blogs/jonathantrull/disrupting-the-kill-chain Fri, 16 Dec 2016 16:58:29 GMT https://blogs.technet.microsoft.com/jonathantrull/?p=35 The cyber kill chain describes the typical workflow, including techniques, tactics, and procedures or TTPs, used by attackers to infiltrate an organization’s networks and systems.  The Microsoft Global Incident Response and Recovery (GIRR) Team and Enterprise Threat Detection Service, Microsoft’s managed cyber threat detection service, identify and respond to thousands of targeted attacks per year.  Based on our experience, the image below illustrates how most targeted cyber intrusions occur today. attack-kill-chain  The initial attack typically includes the following steps:
  • External recon –  During this stage, the attacker typically searches publicly available sources to identify as much information as possible about their target.  This will include information about the target’s IP address range, business operations and supply chain, employees, executives, and technology utilized.  The goal of this stage is to develop sufficient intelligence to increase the chances of a successful attack. If the attacker has previously penetrated your environment, they may also refer to intelligence gathered during previous incursions.
  • Compromised machine – Attackers continue to use socially engineered attacks to gain an initial foothold on their victim’s network.  Why?  Because these attacks, especially if targeted and based on good intelligence, have an extremely high rate of success.  At this stage, the attacker will send a targeted phishing email to a carefully selected employee within the organization.  The email will either contain a malicious attachment or a link directing the recipient to a watering hole.  Once the user executes the attachment or visits the watering hole, another malicious tool known as a backdoor will be installed on the victim’s computer giving the attacker remote control of the computer.
  • Internal Recon and Lateral Movement – Now that the attacker has a foothold within the organization’s network, he or she will begin gathering information not previously available externally.  This will include performing host discovery scans, mapping internal networks and systems, and attempting to mount network shares.  The attacker will also begin using freely available, yet extremely effective tools, like Mimikatz and WCE to harvest credentials stored locally on the initially compromised machine and begin planning the next stage of the attack as shown below.
  high-privileges-lateral-movement-cycle
  • Domain Dominance – At this stage, the attacker will attempt to elevate their level of access to a higher trusted status within the network.  The attacker’s ultimate goal is to access your data and the privileged credentials of a domain administrator offers them many ways to access to your valuable data stores.  Once this occurs, the attacker will begin to pivot throughout the network either looking for valuable data or installing ransomware for future extortion attempts or both.
  • Data Consolidation and Exfiltration – Now that the attacker has access to the valuable data within the organization’s systems, he or she must consolidate it, package it up, and send it out of the network without being detected or blocked.  This is typically accomplished by encrypting the data and transferring it to an external system controlled by the attacker using approved network protocols like DNS, FTP, and SFTP or Internet-based file transfer solutions.

Microsoft Secure and Productive Enterprise

The Microsoft Secure and Productive Enterprise is a suite of product offerings that have been purposely built to disrupt this cyber attack kill chain while still ensuring an organization’s employees remain productive.  Below, I briefly describe how each of these technologies disrupts the kill chain:
  • Office 365 Advanced Threat Protection – This technology is designed to disrupt the “initial compromise” stage and raise the cost of successfully using phishing attacks. Most attackers leverage phishing emails containing malicious attachments or links pointing to watering hole sites. Advanced Threat Protection (ATP) in Office 365 provides protection against both known and unknown malware and viruses in email, provides real-time (time-of-click) protection against malicious URLs, as well as enhanced reporting and trace capabilities.  Messages and attachments are not only scanned against signatures powered by multiple antimalware engines and intelligence from Microsoft’s Intelligent Security Graph, but are also routed to a special detonation chamber, run, and the results analyzed with machine learning and advanced analysis techniques for signs of malicious behavior to detect and block threats. Enhanced reporting capabilities also make it possible for security teams to quickly identify and respond to email based attacks when they occur.
  • Windows 10 –  This technology disrupts the compromised machine and lateral movement stages by raising the difficulty of successfully compromising and retaining control of a user’s PC and by protecting the accounts and credentials stored and used on the device. If an attacker still manages to deliver malware through to one of the organization’s employees by some other mechanism (e.g., via personal email), Windows 10’s security features are designed to both stop the initial infection, and if infected, prevent further lateral movement. Specifically, Windows Defender Application Guard uses new, hardware based virtualization technology to wrap a protective border around the Edge browser.  Even if malware executes within the browser, it cannot access the underlying operating system and is cleaned from the machine once the browser is closed.  Windows Device Guard provides an extra layer of protection to ensure that only trusted programs are loaded and run preventing the execution of malicious programs, and Windows Credential Guard uses the same hardware based virtualization technology discussed earlier to prevent attackers who manage to gain an initial foothold from obtaining other credentials stored on the endpoint.  And finally, Windows Defender Advanced Threat Protection is the DVR for your company’s security team.  It provides a near real-time recording of everything occurring on your endpoints and uses built-in signatures, machine learning, deep file analysis through detonation as a service, and the power of the Microsoft Intelligent Security Graph to detect threats.  It also provides security teams with remote access to critical forensic data needed to investigate complex attacks.
  • Microsoft Advanced Threat Analytics – This technology disrupts the lateral movement phase by detecting lateral movement attack techniques early, allowing for rapid response. If an attacker still manages to get through the above defenses, compromise credentials, and moves laterally, the Microsoft Advanced Threat Analytics (ATA) solution provides a robust set of capabilities to detect this stage of an attack.  ATA uses both detection of known attack techniques as well as a user-based analytics that learns what is “normal” for your environment so it can spot anomalies that indicate an attack. Microsoft ATA can detect internal recon attempts such as DNS enumeration, use of compromised credentials like access attempts during abnormal times, lateral movement (Pass-the-Ticket, Pass-the-Hash, etc.), privilege escalation (forged PAC), and domain dominance activities (skeleton key malware, golden tickets, remote execution).
  • Azure Security Center – While Microsoft ATA detects cyber attacks occurring within an organization’s data centers, Azure Security Center extends this level of protection into the cloud.
And now for the best part.  As shown in the image below, each of the above listed technologies is designed to work seamlessly together and provide security teams with visibility across the entire kill chain.   disrupting-the-kill-chain  Each of these technologies also leverage the power of the Microsoft Intelligent Security Graph, which includes cyber threat intelligence collected from Microsoft’s products and services, to provide the most comprehensive and accurate detections.
  • Cloud App Security, Intune, Azure Information Protection, and Windows 10 Information Protection – And finally, the Microsoft Secure and Productive Enterprise Suite provides significant capabilities to classify and protect data and prevent its loss.  Among other capabilities, Microsoft Cloud App Security can identify and control the use of unsanctioned cloud applications.  This helps organizations prevent data loss, whether from an attack or rogue employee, via cloud-based applications.  Intune and Windows 10 Information Protection prevent corporate data from being intermingled with personal data or used by unsanctioned applications whether on a Windows 10 device or on iOS or Android based mobile devices.  And finally, Azure Information Protection provides organizations and their employees with the ability to classify and protect data using digital rights management technology.  Organizations can now implement and enforce a need-to-know strategy thereby significantly reducing the amount of unencrypted data available should an attacker gain access to their network.
Finally, Microsoft’s Enterprise Cybersecurity Group (ECG) also offers a range of both proactive and reactive services that leverages the capabilities of the Secure and Productive Enterprise suite in combination with the Intelligent Security Graph to help companies detect, respond to, and recover from attacks. In the coming weeks, I will be following up with blogs and demos that go deeper into each of the above listed technologies and discuss how companies can most effectively integrate these solutions into their security strategies, operations, and existing technologies.  To learn more about Microsoft technologies visit Microsoft Secure..
]]> Use Security Education and Awareness Programs to Your Advantage https://docs.microsoft.com/archive/blogs/jonathantrull/use-security-education-and-awareness-programs-to-your-advantage Fri, 07 Oct 2016 04:30:58 GMT https://blogs.technet.microsoft.com/jonathantrull/?p=25
  • New employees are provided with access to online resources such as information security policies and how-to guides for key security technologies and scenarios, e.g. how do I send a secure email, how do I handle PII, etc.
  • For all new employees, I recommend phishing them within their first month on the job and providing JIT training if they fail the test. Rinse and repeat to ensure the training was effective.
  • Employees should be rewarded for identifying security vulnerabilities and reporting them to security. I would suggest a “catch of the month” program where the employee who reported the most impactful vulnerability for that month receives a $100 prepaid gift card or something similar.
    • 2) For Company Executives
    • Companies should develop and deliver a tailored security education program for executives. The training should be custom to the individual executive and should be based on the most likely digital threats to the executive and their family. This type of program should be coordinated with other physical security programs if such exists, as online and physical threats to executives are often linked. I recommend one-on-one training with the executive once per year, as the most effective mechanism for this audience.
    3) For Traveling Employees
    • For companies with employees traveling overseas, provide specific just-in-time (JIT) training based on the countries being visited. Focus on the key tasks they need to perform while traveling, such as accessing email and sending documents, and what to do in case of a suspected breach or an attempted seizure of technology resources. Equally important is to ensure the employee understands any actions they need to take when returning from certain, high risk countries.
    4) For IT Employees:
    • Provide targeted training to information technology staff. Ensure developers know how to use secure coding best practices and secure and handle source code and other intellectual property. Make sure that all system administrators are well versed in the dangers of using domain administrator accounts to perform high risk functions such as browsing the Internet or reading email. Also, ensure that system administrators are trained on the corporate policy regarding the safe handling of such accounts. I’ve attached a few helpful resources below on this specific topic.
    5) For all employees:
    • Security teams should consider their end users as one of their most important and valuable detection sensors and work to maintain the health (“knowledge”) of these sensors just like their IDS/IPS devices and endpoint sensors. This means providing end users with continual training and education, especially related to new threats.
    • Consider flash cyber threat advisories to potentially targeted end users. I’ve also used short (less than one minute) video updates on important topics with great success. Video updates are simply short videos that give end users quick, actionable direction on security topics in a fun and interactive format.
    • For existing employees, perform simulating phishing for a percentage of the user base each month until all employees have been tested. Similar to new employees, provide JIT training for those failing the test, and rinse and repeat to ensure training effectiveness.
    • Finally, gamify your security awareness training and make it mobile friendly. Keep the content fresh and engaging for all generations of your workforce. Also, make the training relevant to both the employee’s work and home life, including being safe on social media. You know you got it right when your employees ask if they can include their family and friends in the training!
    Resources for protecting domain admin credentials: Credential Theft and How to Secure Credentials Securing privileged access: Preventing and detecting attacks]]>         Detecting Sticky Key Backdoors https://docs.microsoft.com/archive/blogs/jonathantrull/detecting-sticky-key-backdoors Mon, 03 Oct 2016 18:55:10 GMT https://blogs.technet.microsoft.com/jonathantrull/?p=1 https://github.com/TrullJ/sticky-keys-scanner You can run the PowerShell script locally or remotely via the Invoke-Command cmdlet. Details of Backdoor: The original attack involved replacing the C:\Windows\System32\sethc.exe binary, or one of the other accessibility suite binaries, with something that could access the underlying OS, like cmd.exe. When the executables are switched, you can bypass the login and get a system level command prompt by pushing the associated "sticky key" - e.g., Shift-key five times in a row quickly if sethc.exe is replaced. Sethc.exe and the other accessibility binaries are executed pre-login, so the attacker would have an immediate backdoor to the system without requiring authentication. Another variant of the attack works by setting cmd.exe, or another program, as a debugger to one of the accessibility suite binaries. This requires one addition to the registry and the attacker doesn’t need to worry about the file replacement described previously. For sethc.exe, the registry change might look like the following: REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /t REG_SZ /v Debugger /d “C:\windows\system32\cmd.exe” /f Another common variant leverages Utilman, a different part of the accessibility suite.  This is identical to the previous attack but sets cmd.exe as the debugger for utilman.exe. The attacker would then push the Windows Key + U and a system level command prompt would present itself.  For this particular persistence method, the registry change would look like the following: REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe" /t REG_SZ /v Debugger /d “C:\windows\system32\cmd.exe” /f One key note is that these are post compromise indicators. The attacker would have already compromised the systems or had physical access to the machine. Detecting the Attacks: There are two approaches for detecting the presence of this particular backdoor. 1. Match Hashes – backdoor exists if one of the binaries in the Microsoft accessibility suite matches a binary that provides system-level access - e.g., cmd.exe or explorer.exe. 2. Registry Analysis – The next method for detecting this backdoor is to review the registry and determine if cmd.exe or another program providing system-level access has been set as the debugger for utilman.exe or sethc.exe. You can also review Windows event logs for a history of registry changes that match this signature; however, this technique is not currently included in the scanner's functionality. The scanner looks for both backdoor variants - binary replacement and registry modification. Happy hunting and please share any improvements to the code via github so we can all be stronger together![bing_translator]]]>