{"id":35600,"date":"2020-06-18T16:00:03","date_gmt":"2020-06-18T16:00:03","guid":{"rendered":"https:\/\/www.microsoft.com\/security\/blog\/?p=91346"},"modified":"2020-06-18T16:00:03","modified_gmt":"2020-06-18T16:00:03","slug":"inside-microsoft-threat-protection-mapping-attack-chains-from-cloud-to-endpoint","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/inside-microsoft-threat-protection-mapping-attack-chains-from-cloud-to-endpoint\/","title":{"rendered":"Inside Microsoft Threat Protection: Mapping attack chains from cloud to endpoint"},"content":{"rendered":"

The increasing pervasiveness of cloud services in today\u2019s work environments, accelerated by a crisis that forced companies around the globe to shift to remote work, is significantly changing how defenders must monitor and protect organizations. Corporate data is spread across multiple applications\u2014on-premises and in the cloud\u2014and accessed by users from anywhere using any device. With traditional surfaces expanding and network perimeters disappearing, novel attack scenarios and techniques are introduced.<\/p>\n

Every day, we see attackers mount an offensive against target organizations through the cloud and various other attack vectors with the goal of finding the path of least resistance, quickly expanding foothold, and gaining control of valuable information and assets. To help organizations fend off these advanced attacks, Microsoft Threat Protection (MTP)<\/a> leverages the Microsoft 365 security portfolio to automatically analyze cross-domain threat data, building a complete picture of each attack in a single dashboard. With this breadth and depth of clarity, defenders can focus on critical threats and hunting for sophisticated breaches across endpoints, email, identities and applications.<\/p>\n

Among the wide range of actors that Microsoft tracks\u2014from digital crime groups to nation-state activity groups\u2014HOLMIUM is one of the most proficient in using cloud-based attack vectors. Attributed to a Middle East-based group and active since at least 2015, HOLMIUM has been performing espionage and destructive attacks targeting aerospace, defense, chemical, mining, and petrochemical-mining industries. HOLMIUM\u2019s activities and techniques overlap with what other researchers and vendors refer to as APT33, StoneDrill, and Elfin.<\/p>\n

HOLMIUM has been observed using various vectors for initial access, including spear-phishing email, sometimes carrying archive attachments that exploit the CVE-2018-20250<\/a> vulnerability in WinRAR, and password-spraying. Many of their recent attacks, however, have involved the penetration testing tool Ruler<\/a> used in tandem with compromised Exchange credentials.<\/p>\n

The group used Ruler to configure a specially crafted Outlook Home Page<\/a> URL to exploit the security bypass vulnerability CVE-2017-11774<\/a>, which was fixed<\/a> shortly after it was discovered. Successful exploitation automatically triggered remote code execution of a script when an Outlook client synced with a mailbox and rendered the profile Home Page URL. These scripts, usually VBScript followed by PowerShell, in turn initiated the delivery of various payloads.<\/p>\n

In this blog, the first in the Inside Microsoft Threat Protection series, we will show how MTP provides unparalleled end-to-end visibility into the activities of nation-state level attacks like HOLMIUM. In succeeding blog posts in this series, we will shine a spotlight on aspects of the coordinated defense delivered by Microsoft Threat Protection.<\/p>\n

Tracing an end-to-end cloud-based HOLMIUM attack<\/h2>\n

HOLMIUM has likely been running cloud-based attacks with Ruler since 2018, but a notable wave of such attacks was observed in the first half of 2019. These attacks combined the outcome of continuous password spray activities against multiple organizations, followed by successful compromise of Office 365 accounts and the use of Ruler in short sequences to gain control of endpoints. This wave of attacks was the subject of a warning from US Cybercom<\/a> in July 2019.<\/p>\n

These HOLMIUM attacks typically started with intensive password spray against exposed Active Directory Federation Services<\/a> (ADFS) infrastructure; organizations that were not using multi-factor authentication (MFA) for Office 365 accounts had a higher risk of having accounts compromised through password spray. After successfully identifying a few user and password combinations via password spray, HOLMIUM used virtual private network (VPN) services with IP addresses associated with multiple countries to validate that the compromised accounts also had access to Office 365.<\/p>\n

<\/p>\n

Figure 1. Password spray and compromised account sign-ins by HOLMIUM as detected in Azure Advanced Threat Protection (ATP) and Microsoft Cloud App Security (MCAS)<\/em><\/p>\n

Armed with a few compromised Office 365 accounts and not blocked by MFA defense, the group launched the next step with Ruler and configured a malicious Home Page URL which, once rendered during a normal email session, resulted in the remote code execution of a PowerShell backdoor through the exploitation of a vulnerability like CVE-2017-11774<\/a>. The two domains abused by HOLMIUM and observed during this 2019 campaign were \u201ctopaudiobook.net<\/em>\u201d and \u201ccustomermgmt.net<\/em>\u201d.<\/p>\n

<\/p>\n

Figure 2. Exploitation of Outlook Home Page feature using Ruler-like tools<\/em><\/p>\n

<\/p>\n

Figure 3. Weaponized home page and initial PowerShell payload<\/em><\/p>\n

This initial foothold allowed HOLMIUM to run their custom PowerShell backdoor (known as POWERTON<\/a>) directly from an Outlook process and to perform the installation of additional payloads on the endpoint with different persistence mechanisms, such as WMI subscription (T1084)<\/a> or registry autorun keys (T1060)<\/a>. Once the group has taken control of the endpoint (in addition to the cloud identity), the next phase was hours of exploration of the victim\u2019s network, enumerating user accounts and machines for additional compromise, and lateral movement within the perimeter. HOLMIUM attacks typically took less than a week from initial access via the cloud to obtaining unhampered access and full domain compromise, which then allowed the attackers to stay persistent for long periods of time, sometimes for months on end.<\/p>\n

<\/p>\n

Figure 4. Snippets of HOLMIUM PowerShell backdoor (POWERTON) implementing two different persistence mechanisms: WMI event subscription (T1084) and Registry run keys or Startup folder (T1060)<\/em><\/p>\n

HOLMIUM attacks as seen and acted upon by Microsoft Threat Protection<\/h2>\n

HOLMIUM attacks demonstrate how hybrid attacks that span from cloud to endpoints require a wide range of sensors for comprehensive visibility. Enabling organizations to detect attacks like these by correlating events in multiple domains \u2013 cloud, identity, endpoints \u2013 is the reason why we build products like Microsoft Threat Protection. As we described in our analysis of HOLMIUM attacks, the group compromised identities in the cloud and leveraged cloud APIs to gain code execution or persist. The attackers then used a cloud email configuration to run specially crafted PowerShell on endpoints every time the Outlook process is opened.<\/p>\n

During these attacks, many target organizations reacted too late in the attack chain\u2014when the malicious activities started manifesting on endpoints via the PowerShell commands and subsequent lateral movement behavior. The earlier attack stages like cloud events and password spray activities were oftentimes missed or sometimes not linked with activities observed on the endpoint. This resulted in gaps in visibility and, subsequently, incomplete remediation.<\/p>\n

While it\u2019s relatively easy to remediate and stop malicious processes and downloaded malware on endpoints using endpoint security solutions, such a conventional approach would mean that the attack is persistent in the cloud, so the endpoint could be immediately compromised again. Remediating identities in the cloud is a different story.<\/p>\n

<\/p>\n

Figure 5. The typical timeline of a HOLMIUM attack kill-chain<\/em><\/p>\n

In an organization utilizing MTP, multiple expert systems that monitor various aspects of the network would detect and raise alerts on HOLMIUM\u2019s activities. MTP sees the full attack chain across domains beyond simply blocking on endpoints or zapping emails, thus putting organizations in a superior position to fight the threat.<\/p>\n

<\/p>\n

Figure 6. MTP components able to prevent or detect HOLMIUM techniques across the kill chain.<\/em><\/p>\n

These systems work in unison to prevent attacks or detect, block, and remediate malicious activities. Across affected domains, MTP detects signs of HOLMIUM\u2019s attacks:<\/p>\n