In early July, Microsoft announced Storm-0558 where a Chinese threat actor used forged authentication tokens to access the information – primarily email accounts – of about 25 organizations. This attack included some significant organizations including the US Department of Commerce and, reportedly, the US Ambassador to China. The attack was particularly concerning because Microsoft revealed that the attacker was forging Azure AD tokens using an acquired Microsoft account signing key. In Microsoft’s words, "Though the key was intended only for MSA accounts, a validation issue allowed this key to be trusted for signing Azure AD tokens. This issue has been corrected."
(CISA has posted guidance for addressing the threat here. Microsoft has also expanded licensing for Purview to include companies that do not have an E5/G5 license.)
On July 26, we announced HYPR Adapt which helps organizations to maintain real-time risk assessment and adaptive security controls. In other words, it’s entirely focused on protecting authentication by detecting anomalous activity and taking action such as requiring re-authentication.
While Microsoft believes that Storm-0558 has been mitigated, it’s instructive to look at how monitoring could be employed to address scenarios where their MSA or Azure AD signing keys have been compromised.
One of the key observations is that because of Adapt’s ability to deploy Policy as Code, it can be quickly updated with new policies based on recently identified threats known as IOC and IOA. Once the risk has been identified, HYPR Adapt takes targeted action against the identified risk. These patterns can be detected and action taken to revoke access or mitigate the impact of a newly identified identity threat.
Below are the implementation steps to prevent identity-based attacks in the event that a Microsoft signing key is compromised.
The HYPR Adapt policy can also be implemented to alert the enterprise SOC or similar to be notified and react to any indicators of compromise. However, we believe that having actionable insights and policies that can be executed in real-time is critical for reacting to threats quickly and decisively with accuracy. This is what HYPR Adapt is enabling our customers to do!
Microsoft indicated in early July that Storm 0558 has been fully mitigated. Smart security teams are continuing to look for other examples where compromised tokens are being utilized to create new attack vectors.
Finding evidence of attack in the rearview mirror is now insufficient. Risk assessment needs to include the ability to automatically take action to defend against identity threats while minimizing the overall impact to the user experience. Interested? Contact us to find out more about HYPR Adapt.