US-CERT- TA18-276A: Using Rigorous Credential Control to Mitigate Trusted Network Exploitation

[Netwörkheäd]

TA18-276A: Using Rigorous Credential Control to Mitigate Trusted Network Exploitation

[html]Original release date: October 3, 2018

Systems Affected

Network Systems

Overview

This technical alert addresses the exploitation of trusted network relationships and the subsequent illicit use of legitimate credentials by Advanced Persistent Threat (APT) actors. It identifies APT actors' tactics, techniques, and procedures (TTPs) and describes the best practices that could be employed to mitigate each of them. The mitigations for each TTP are arranged according to the https://www.nist.gov/cyberframework/framework">National Institute of Standards and Technology (NIST) Cybersecurity Framework core functions of Protect, Detect, Respond, and Recover.

Description

APT actors are using multiple mechanisms to acquire legitimate user credentials to exploit trusted network relationships in order to expand unauthorized access, maintain persistence, and exfiltrate data from targeted organizations. Suggested best practices for administrators to mitigate this threat include auditing credentials, remote-access logs, and controlling privileged access and remote access.

Impact

APT actors are conducting malicious activity against organizations that have trusted network relationships with potential targets, such as a parent company, a connected partner, or a contracted managed service provider (MSP). APT actors can use legitimate credentials to expand unauthorized access, maintain persistence, exfiltrate data, and conduct other operations, while appearing to be authorized users. Leveraging legitimate credentials to exploit trusted network relationships also allows APT actors to access other devices and other trusted networks, which affords intrusions a high level of persistence and stealth.

Solution

Recommended best practices for mitigating this threat include rigorous credential and privileged-access management, as well as remote-access control, and audits of legitimate remote-access logs. While these measures aim to prevent the initial attack vectors and the spread of malicious activity, there is no single proven threat response.

Using a defense-in-depth strategy is likely to increase the odds of successfully disrupting adversarial objectives long enough to allow network defenders to detect and respond before the successful completion of a threat actor's objectives.

Any organization that uses an MSP to provide services should monitor the MSP's interactions within their organization's enterprise networks, such as account use, privileges, and access to confidential or proprietary information. Organizations should also ensure that they have the ability to review their security and monitor their information hosted on MSP networks.

APT TTPs and Corresponding Mitigations

The following table displays the TTPs employed by APT actors and pairs them with mitigations that network defenders can implement.

Table 1: APT TTPs and Mitigations

APT TTPs	Mitigations
Preparation
Allocate operational infrastructure, such as Internet Protocol addresses (IPs). Gather target credentials to use for legitimate access.	Protect: Educate users to never click unsolicited links or open unsolicited attachments in emails. Implement an awareness and training program. Detect: Leverage multi-sourced threat-reputation services for files, Domain Name System (DNS), Uniform Resource Locators (URLs), IPs, and email addresses.
Engagement
Use legitimate remote access, such as virtual private networks (VPNs) and Remote Desktop Protocol (RDP). Leverage a trusted relationship between networks.	Protect: Enable strong spam filters to prevent phishing emails from reaching end users. Authenticate inbound email using Sender Policy Framework; Domain-Based Message Authentication, Reporting and Conformance; and DomainKeys Identified Mail to prevent email spoofing. Prevent external access via RDP sessions and require VPN access. Enforce multi-factor authentication and account-lockout policies to defend against brute force attacks. Detect: Leverage multi-sourced threat-reputation services for files, DNS, URLs, IPs, and email addresses. Scan all incoming and outgoing emails to detect threats and filter out executables. Audit all remote authentications from trusted networks or service providers for anomalous activity. Respond and Recover: Reset credentials, including system accounts. Transition to multifactor authentication and reduce use of password-based systems, which are susceptible to credential theft, forgery, and reuse across multiple systems.
Presence
Execution and Internal Reconnaissance: Write to disk and execute malware and tools on hosts. Use interpreted scripts and run commands in shell to enumerate accounts, local network, operating system, software, and processes for internal reconnaissance. Map accessible networks and scan connected targets. Lateral Movement: Use remote services and log on remotely. Use legitimate credentials to move laterally onto hosts, domain controllers, and servers. Write to remote file shares, such as Windows administrative shares. Credential Access: Locate credentials, dump credentials, and crack passwords.	Protect: Deploy an anti-malware solution, which also aims to prevent spyware and adware. Prevent the execution of unauthorized software, such as Mimikatz, by using application whitelisting. Deploy PowerShell mitigations and, in the more current versions of PowerShell, enable monitoring and security features. Prevent unauthorized external access via RDP sessions. Restrict workstations from communicating directly with other workstations. Separate administrative privileges between internal administrator accounts and accounts used by trusted service providers. Enable detailed session-auditing and session-logging. Detect: Audit all remote authentications from trusted networks or service providers. Detect mismatches by correlating credentials used within internal networks with those employed on external-facing systems. Log use of system administrator commands, such as net, ipconfig, and ping. Audit logs for suspicious behavior. Use whitelist or baseline comparison to monitor Windows event logs and network traffic to detect when a user maps a privileged administrative share on a Windows system. Leverage multi-sourced threat-reputation services for files, DNS, URLs, IPs, and email addresses. Respond and Recover: Reset credentials. Monitor accounts associated with a compromise for abnormal behaviors, including unusual connections to nonstandard resources or attempts to elevate privileges, enumerate, or execute unexpected programs or applications.
Effect
Maintain access to trusted networks while gathering data from victim networks. Compress and position data for future exfiltration in archives or in unconventional locations to avoid detection. Send over command and control channel using data-transfer tools (e.g., PuTTY secure copy client [PSCP], Robocopy).	Protect: Prevent the execution of unauthorized software, such as PSCP and Robocopy. Detect: Monitor for use of archive and compression tools. Monitor egress traffic for anomalous behaviors, such as irregular outbound connections, malformed or abnormally large packets, or bursts of data to detect beaconing and exfiltration.

[deanwebb]

Not an alert as such, just an outline of good, solid security practice.