Detection Engineering

Share this post

Detection Engineering Weekly #32 - Ackshually, it's "Entra ID" now

www.detectionengineering.net

Discover more from Detection Engineering

The latest news and how-tos in detection engineering
Over 4,000 subscribers
Continue reading
Sign in

Detection Engineering Weekly #32 - Ackshually, it's "Entra ID" now

My toxic trait is spot correcting anyone saying Azure AD

Zack 'techy' Allen
Jul 19, 2023
4
Share this post

Detection Engineering Weekly #32 - Ackshually, it's "Entra ID" now

www.detectionengineering.net
Share

Welcome to Issue #32 of Detection Engineering Weekly!

This week’s recap:

Detection Engineering is a reader-supported publication. To receive new posts and support my work, consider becoming a free or paid subscriber.

  • 💎 by Greg Ake on forming a hypothesis

  • Gary Katz continues dropping 🔥 LIT 🔥 posts on detection metrics, and David Bianco rounds out the 1-2 punch with baselining using the PEAK framework

  • Erica Zelic on LDAP queries just in case BloodHound disappears, Curated Intel publishes a threat actor profile guide, and Rhino Security releases a new tool to help with hunting Actions in AWS

  • Storm-0558 steals Microsoft keys, maybe Microsoft should get an Apple Airtag? The Permiso team strikes back at (Jay &) Silent Bob, more CISA KEV drops

plus so much more!

QUICK SHOUTOUT TO CLINT @ TL;DR SEC!

🎉🎉 Congrats Clint Gibler, creator and maintainer of the tl;dr sec newsletter, on hitting 18,000 subscribers! I modeled (cough copied cough) several parts of my newsletter after Clint’s excellent security newsletter. When I shot him a message about how much I appreciate his work, he immediately asked if I wanted to get on a Zoom and chat about newsletters, work and life. I really appreciated that, so thank you Clint! Please go give tl;dr sec a subscribe and tell him I sent you!

Dear 🟪 , 🟥, 🟦 teamers and everyone in between

Call my hotline? I need a few more “rants” about purple teaming before I start editing and publishing! Imagine one of those morning talkshows with people calling in ranting about whatever and whoever. I’d love to hear your rants on security, threat detection, purple teaming and everything else.

📱📱📱+1 954-280-0080📱📱📱

🫵 Hey you! Do you have a blog post, social link, or open-source tool you want to see in this newsletter?

Leave a comment below or email me techy@detectionengineering.net


💎 Detection Engineering Gem 💎

Where to begin - Formulating a Hypothesis by Greg Ake

60% of the time, we miss the basics every time

This quote is a fun way to start a blog post :). What is your decision-making process when you start building out a new detection or a suite of detections? How much evidence do you have? Do you also document how much you don’t know, a.k.a. a gap analysis? This is where the scientific method can help a detection team, but let’s be specific: formulating a hypothesis on detections requires diligence.

Ake covers the art of doing diligence when formulating a hypothesis. We tend to get lazy when we find an outcome we like, such as a causal relationship between your detection and telemetry on the wire. We rush to ship the rule and move on to the next one. But what about when something doesn’t go as expected? It’s just as important.

If I were you, I would spend some time and read this gem and move directly below to Katz’s post on validation, followed by Bianco’s post on threat hunting via baselining. It’s a crescendo of the application of the scientific method!


State of the Art

Quantifying Detection Coverage with Validation by Gary Katz

Katz continues his posts on measuring the effectiveness of a detection engineering program. This post dives into the idea of detection coverage validation. The intricacies of a valid detection are fickle and easily thwarted, mainly if you aren’t focusing on separate ways to achieve the same procedure. Jared Atkinson talks about this subject with function chaining (and we’ve highlighted this in this newsletter!). I love this graphic Katz uses about the fundamental problem of detection:

If you assume you will never have full coverage into the unknown, you can take many steps to validate as much as possible before there are diminishing returns.


Baseline Hunting with the PEAK Framework by David Bianco

Bianco lays out the strategy behind baseline threat hunting to round out previous posts on the PEAK framework. Baselining is a way to collect representative telemetry samples, whether you onboard new data or are in a new environment. Once you onboard this data, you can start looking at ways to look for outliers outside a baseline. Bianco mentions stack counting or “group by → sort to least occurring” and Z-scores to look for P95 or P99 values. After the “Execute” phase, you can review your baselines and make detections.


Detecting BPFDoor Backdoor Variants Abusing BPF Filters by Fernando Merces

BPFDoor has been one of the most fascinating rootkits on Linux since I started in security. By abusing eBPF programs, you insert your code in the packet parsing process (before even being evaluated by the firewall), and you can get deep into victim boxes. There isn’t too much here that is “new,” but it was a great review of everything that has led up to the current incarnations of BPFDoor.


LDAP Queries for Offensive and Defensive Operations by Erica Zelic

Zelic uses this blog post to document the most common (and interesting) LDAP queries for blue and red team exercises. This would be useful for detection engineers who rely heavily on BloodHound and may want to look a bit deeper into how the underlying LDAP subsystem works.


The Threat Actor Profile Guide for CTI Analysts by Curated Intel

Have you ever wanted to know how to communicate a “threat actor profile” to stakeholders? If you want to infuse the rigor of cyber threat intelligence into your detection backlog, whether in documentation or detection descriptions, this is a great tool for building profiles on groups your company may be concerned with. The “TTPs” section is excellent, but your leadership or stakeholders may not care about them as much as they are concerned with the adversary’s motivations. 


Spraying the Microsoft Cloud by BlueTeamOps

We need WAY more blog posts like this one! The author took several open-source tools related to Azure MFA spraying and logged the event types and telemetry that Azure generated. I’ve linked various MFA spraying tools on this newsletter, but aggregation posts like this one help you orient around the technique rather than just individual tools. 


IAMActionHunter: Query AWS IAM permission policies with ease by David Yesland

The team behind pacu, one of the most popular open-source AWS penetration tools, released IAMActionHunter to help users understand the blast radius of IAM permissions on AWS. Yesland showcases an example where the tool found a privilege escalation path on a vulnerable role that they claim other tools couldn’t find.

Detection Engineering on Social Media

Link: https://twitter.com/curi0usJack/status/1679971626836987904

Timely tweet following Katz’ post above.

Link: https://twitter.com/burning_pm/status/1679598514576211969

It’s easy to pile on Fortinet, but this is also true!

Link: https://twitter.com/lorenzofb/status/1680982461721763845

Crypto was a mistake. But if you ever need to fund a nuclear program, you should save this picture!


Threat Landscape

Microsoft mitigates China-based threat actor Storm-0558 targeting of customer email by Microsoft Security Response Center

An alleged China-based threat actor group, Storm-0558, was discovered targeting Microsoft customer emails. The scary part about this specific incident isn’t that customers were successfully compromised but that Storm-0558 obtained a Microsoft Signing key (MSA) to forge authentication tokens. Microsoft blocked and rotated the key, but it’s wild to think that the company still hasn’t figured out how it was compromised and that it was a “golden ticket” to Microsoft-hosted OWA/Outlook accounts as well as Azure AD (ahem, Entra ID) accounts.


Analysis of Storm-0558 techniques for unauthorized email access by Microsoft Threat Intelligence

This is a much more technical blog post than the MSRC one listed above, so if you want to get into details of the Actor origins and TTPs, read this one! The MSTIC team says the actor “acquired an inactive MSA consumer signing key and used it to forge authentication tokens for Azure AD enterprise and MSA consumers.” I am very interested in how Microsoft handles this incident moving forward and if they’ll release any details on how the key was compromised.


Agile Approach to Mass Cloud Credential Harvesting and Crypto Mining Sprints Ahead by Abian Morina

Besides having one of the best banner images for any security blog I’ve read, this is a great post detailing how commodity crimeware targeting cloud environments is evolving. These actors are updating tooling to target more than just AWS: GCP, Azure, and Kubernetes are all on the menu. The actors were also helpful and provided a Gitlog of all the changes they’ve made! But the best part? Detection opportunities at the bottom! 


FIN8 Uses Revamped Sardonic Backdoor to Deliver Noberus Ransomware by Symantec Threat Hunter Team

According to Symantec researchers, Syssphinx, aka FIN8, has pivoted from POS attacks to Ransomware. The FIN8 group “revamped” Sardonic, a toolset researched by Bitdefender years ago, and is actively using it against victims. It seems FIN8 got so upset with using C++ that they switched to good old C. 


CISA Adds One Known Exploited Vulnerability to Catalog AND CISA Adds Two Known Vulnerabilities to Catalog by CISA

Two announcements here: CISA adds three known exploited vulnerabilities to their catalog: one Microsoft, one Apple, and one SolarView vulnerability. The SolarView one is from last year, while the Microsoft & Apple vulnerabilities are from their company’s latest releases. 

Open Source

IAMActionHunter by RhinoSecurityLabs

GitHub repo link to the RhinoSecurityLabs tool posted above in “State of the Art.”


edge by iknowjason

Opinionated cloud IP attribution lookup tool. It does way more than just identify where an IP belongs to a cloud service provider - there’s some reverse DNS and Certificate Transparency magic that gives the whole picture behind a Cloud IP.


LOLAPPS by LOLAPPS-Project

New lolfarm project, this time with applications! If any of your organizations are using applications listed in lolapps, I highly recommend looking at how to detect attacks on them by using this project.


LinuxForensics by ashemery

This GitHub repo is an amalgamation of what looks like many talks and workshops on Linux forensics. Star this one and come back to it when you have a rainy day and want to learn a thing or two about Linux DFIR :).


BadZure by mvelazc0

Want an Azure AD (ARGGHH ENTRA ID) lab that’s misconfigured on purpose? This a great tool that stands up a misconfigured Azure environment out-of-the-box, so you can practice your detection engineering, red teaming, or both!


PentestGPT by GreyDGL

ChatGPT powered automated pentesting tool, all installable with a pip command. Would love to see a red teamer generate a report with findings from this tool, and then written with ChatGPT. Work smarter, not harder!

Detection Engineering is a reader-supported publication. To receive new posts and support my work, consider becoming a free or paid subscriber.

4
Share this post

Detection Engineering Weekly #32 - Ackshually, it's "Entra ID" now

www.detectionengineering.net
Share
Comments
Top
New
Community

No posts

Ready for more?

© 2023 Zack 'techy' Allen
Privacy ∙ Terms ∙ Collection notice
Start WritingGet the app
Substack is the home for great writing