The SolarWinds supply chain cyberattack took the digital world by storm, affecting government agencies and IT giants. To detail the techniques used by the SolarWinds threat actors, also known as UNC2452 actors, cybersecurity firm FireEye released a free tool, dubbed Azure AD Investigator, on GitHub.
FireEye claimed that Azure AD Investigator helps identify Indicators of Compromise (IoC) that require further verification and analysis. The tool will alert security administrators to artifacts that may require further review to determine their legitimacy.
The company also issued a report detailing the attack techniques used by SolarWinds threat actor groups in their recent cyber operations. The report discussed how companies can boost their security landscape and remediate cybersecurity loopholes. FireEye, along with Microsoft and CrowdStrike, recently led several investigations into the SolarWinds cyberattacks. FireEye has observed UNC2452 attackers’ tactics, techniques, and procedures (TTPs) moving laterally to the Microsoft 365 cloud using a combination of four primary techniques. These include:
- Steal the Active Directory Federation Services (AD FS) token-signing certificate and use it to forge tokens for arbitrary users (sometimes described as Golden SAML). This would allow the attacker to authenticate into a federated resource provider (such as Microsoft 365) as any user, without the need for that user’s password or their corresponding multi-factor authentication (MFA) mechanism.
- Modify or add trusted domains in Azure AD to add a new federated Identity Provider (IdP) that the attacker controls. This would allow the attacker to forge tokens for arbitrary users and has been described as an Azure AD backdoor.
- Compromise the credentials of on-premises user accounts that are synchronized to Microsoft 365 that have high privileged directory roles, such as Global Administrator or Application Administrator.
- Backdoor an existing Microsoft 365 application by adding a new application or service principal credential to use the legitimate permissions assigned to the application, such as the ability to read email, send email as an arbitrary user, access user calendars, etc.
