Jago Aartsen
@jagondaCompletionist
0 followers0 downloads25 copies0 likes68 views
3 detections
Filters
Last updated
All Time
Detection languages
3
Categories
1
Platforms
1
1
MITRE Techniques
1
1
1
1
Details: Detection to identify bulk download of files from SharePoint within a short period of time (defined as >= 5000 files downloaded within 10 minutes).
Hypothesis: Adversaries may collect large volumes of sensitive data for exfiltration from cloud storage services such as SharePoint. This is a common technique employed by data extortion focused groups such as ShinyHunters.
Recommended Actions: Conduct review of files downloaded paying particular attention to anything which may be of sensitive nature and could be used for extortion purposes. Ensure files downloaded align with user's role. It may be necessary to confirm activity with user if deemed anomalous.
Reference: https://reliaquest.com/blog/threat-spotlight-shinyhunters-fast-tracks-saas-access-subdomain-impersonation/
Hypothesis: Adversaries may collect large volumes of sensitive data for exfiltration from cloud storage services such as SharePoint. This is a common technique employed by data extortion focused groups such as ShinyHunters.
Recommended Actions: Conduct review of files downloaded paying particular attention to anything which may be of sensitive nature and could be used for extortion purposes. Ensure files downloaded align with user's role. It may be necessary to confirm activity with user if deemed anomalous.
Reference: https://reliaquest.com/blog/threat-spotlight-shinyhunters-fast-tracks-saas-access-subdomain-impersonation/
Details: Detection to identify registry modifications to enable WDigest. Enabling WDigest forces LSASS to store cached credentials in plain text which can be dumped and used immediately for lateral movement/privilege escalation without the need for offline brute-forcing of hashes.
Hypothesis: Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). After a user logs on, the system generates and stores a variety of credential materials in LSASS process memory. These credential materials can be harvested by an administrative user or SYSTEM and used to conduct Lateral Movement using Use Alternate Authentication Material.
Recommended actions: Review process tree and conduct device timeline analysis to determine root cause - it may be necessary to confirm activity with the end user.
References: https://jumpcloud.com/it-index/what-is-wdigest, https://cybersecuritynews.com/exposed-server-reveals-thegentlemen-ransomware-toolkit/
Hypothesis: Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). After a user logs on, the system generates and stores a variety of credential materials in LSASS process memory. These credential materials can be harvested by an administrative user or SYSTEM and used to conduct Lateral Movement using Use Alternate Authentication Material.
Recommended actions: Review process tree and conduct device timeline analysis to determine root cause - it may be necessary to confirm activity with the end user.
References: https://jumpcloud.com/it-index/what-is-wdigest, https://cybersecuritynews.com/exposed-server-reveals-thegentlemen-ransomware-toolkit/
Details: Detection for MFA fatigue attacks where a high number of MFA push denies in a short period are followed by a successful sign-in attempt.
Hypothesis: Adversaries may attempt to bypass multi-factor authentication (MFA) mechanisms and gain access to accounts by generating MFA requests sent to users.
Recommended Actions: Review sign-in logs for user around time of alert and contact them directly to confirm/verify activity.
Hypothesis: Adversaries may attempt to bypass multi-factor authentication (MFA) mechanisms and gain access to accounts by generating MFA requests sent to users.
Recommended Actions: Review sign-in logs for user around time of alert and contact them directly to confirm/verify activity.