(gears whirring) - Up next, I'm joined once again by Microsoft Security CVP Rob Lefferts, to take a look at the latest
integrated defenses and tools to respond in the
context of a real attack. Now we're going to show you how
Microsoft's cloud-based SIM, Azure Sentinel, along
with our XDR technologies, including Microsoft 365 Defender, provide an automated approach to threat detection and response. So, Rob, it's always a great pleasure to have you on the show, but I fear that means that
things are just getting worse. - I know, I feel like
every time I show up, it's always getting worse, but that's just the way
the threat landscape works. You can never rest on your laurels. In all seriousness, compared to my previous times on the show, things have reached a
new level of urgency, whether that's human-operated ransomware or sophisticated command
and control attacks. And the techniques getting
used are getting harder and harder to detect, like the
recent supply chain attacks that embed malware in
the apps that you trust as they are being compiled and packaged. We've also seen malware
come through IoT devices that you would never expect, like using a smart
thermometer in a fish tank to gain access to corporate resources. - Right, but you and the
team are always working on the latest technologies
to be able to keep up and respond to these types of threats. So surely you're going
to tell me there's hope. - We are working hard, but you know, there's more than just hope. That's not a strategy. We can still stop these types of attacks with the right measures and preparation. First, to protect your
users wherever they are, as well as the day-to-day operations of your organization as a whole, you want to have the right defense layers in place from your identities,
endpoints and apps, network, infrastructure,
and ultimately your data to be able to resist
attacks in the first place, which is where the Zero Trust
security model comes in. Second, it's important to increase your organization's
ability to detect and respond before an
attack does any damage. And third, if the damage
has already started, then it's all about
containing the blast radius and reversing any damage
that has already been done and reversing it quickly. On these last two points, this is where you need the visibility and depth of insight
across your organization. Which is where our integrated
SIM with Azure Sentinel and Microsoft 365 Defender and Azure Defender for XDR come into play to apply Microsoft's unique volume and diversity of threat intelligence for early warning and response. - And the nice thing about this unified detection response approach is that you're using a
minimum number of tools to stop a bad situation
from getting worse. - That's right. You really don't want
anything slowing you down, every second counts. So we give you best-in-class
and integrated tools and collect their signals
to connect the dots across the attack chain
so that you don't have to. For example, Microsoft 365
Defender, as I'll show you today, provides an aggregate view of an attack. And it's fed by best-in-class
solutions for identity, endpoints, Office 365 user data, and your apps to give you
cross-domain visibility, as well as coordinated
and automated protection. - Okay, but I really
want to make this real and show this all in the
context of a proper attack. - Yeah, my favorite part. So I'm going to show you
a data exfiltration attack based on real techniques that we've seen deployed in the wild. It's a hybrid attack and
compromise that starts on-premises and uses sophisticated methods to move to cloud-based resources. And so we want comprehensive visibility into the entire scope of the
attack across the entire estate to contain and ultimately stop it. The attack starts as an
email-based campaign. The email contains a link that when clicked starts to
download weaponized documents. It's the oldest story in the world. And it just takes one person in the domain to get duped for the
whole sequence to begin. From there, an open source
app, Mimikatz, is used to find and extract domain admin credentials from the compromised endpoint. And that's when things get seriously bad. Then the hybrid part begins. Those admin creds are used to obtain the ADFS admin
credentials in order to gain access to Active Directory Federation
Services, which by the way, maintains the trust link
between on-premises resources and cloud-based resources
via Azure Active Directory. And then it gets worse. They export the ADFS
token sign-in certificate in order to create a forged SAML token, which gives them their first
footing into the cloud. And once they have access with that token, they request and gain access
to services in the cloud. They can add their own new credentials to a privileged OAuth app in the cloud. And now they have access to high-privileged user mailboxes
hosted on Office 365. And through the graph API, they can extract and exfiltrate data. And really, for anyone who
has been reading the news, this might sound familiar. You'll recognize that this
is exactly the attack pattern that was followed in the
Nobelium exploit last winter. - Okay, so where would you
even begin to start to mitigate and kind of respond to
this type of attack? - So to get a full end-to-end
picture of the attack, we're going to start in Azure Sentinel. This gives us the
largest breadth of signal across third-party and Microsoft signals. So here I'm logged into our tenant, and you can collect signals from Microsoft and non-Microsoft apps and services via more than 100 pre-built connectors. So now let me filter by the
ones we're connected to. You'll see, there are a few
dozen including Azure Defender, Azure Defender for IoT,
and if we scroll down, we're also connected to
Fortinet for our firewall and Microsoft 365 Defender, which is important to our tagged scenario. Now on the Incidents page,
I see 27 new incidents. These comprise alerts, assets,
and evidence to investigate. I'm interested in the
high priority red ones. The first is from Fortinet that shows a data
transfer to an IP address. This could have been the ADFS
creds or token sign-in cert, and I can even see that Microsoft 365 Defender
raised the incident with the most alerts, also 27. So let's investigate this a bit further, and you'll see the info from
our alert from Fortinet data. We can also see that through
an automation playbook, Sentinel has already
enriched this incident with RiskIQ data for the IP address found. RiskIQ is a cybersecurity
threat intelligence service. And we can see that it's provided the DNS and domain details to help
with our investigation. This type of automated enrichment is a unique capability for Sentinel. So now I'll click into
Actions, Investigate. And that brings me to
our investigation graph. From here, I can take a closer
look at the entities involved and how they connect to other incidents. I'll zoom into a machine
in our environment, the ADFS server, and it transferred
data to this IP address, which was captured by Fortinet
and triggered the alert. There are also a bunch
of other alerts related to this machine from
Microsoft 365 Defender. So let's click into this one for the ADFS private
key extraction attempt. If I go to our malicious
IP, we can also see that pgustavo has recently
signed in from here. And another alert from
the Microsoft 365 Defender called Unusual addition of
credentials to an OAuth app. So this is our compromised account logging in from attacker infrastructure, adding new credentials
that I talked about before. So now I can look at
the Entity Insights page for the user pgustavo. Using normal behavioral
patterns for this user, something we call user and
entity behavioral analytics, or UEBA, you can see
that Sentinel detected that a number of actions
were really out of character, such as the location they logged in from, and it looks like they've
also accessed resources that they shouldn't have normally done. So those are flagged as
anomalies for this account. Now let's hop back to the Incidents page, and because this is a
pretty nasty incident I'll need to add a few more people to help investigate and address it. So again, from Actions,
I can create a team, and for this incident, and assign it to the SOC channel group to it. So now Jeremy, you and I
can start to collaborate on how we solve this problem. - All right, so if we
switch over to my machine, we can see that there's some
super useful information as a member of the team. In fact, we can see
contributions already flowing in to the team's channel, and
I can see a hunting query that's posted to look
for processes calling out to our malicious IP address,
all in Defender data. - Great. Let's go hunting. So I'll open up a Hunting page. And in here you can see a ton of out-of-the-box hunting queries across different data sources. Now let's use search to find
the one our colleague created and run it and view the results. And here I can see my
ADFS server called out to this IP address with some
suspicious looking PowerShell. And this third one was running in the context of our ADFS administrator. - So there's really a
breadth of information then about this attack that's in Sentinel, but how do we get more depth on the attack and actually stop it from spreading? - Yeah, there's more you can
do in Microsoft 365 Defender, especially given the
nature of this attack. The good news is that Sentinel
links you directly to it. So back in the Incidents page, I'll select the multi-stage incident with 27 correlated alerts. Those will provide a link directly to the same incident in
Microsoft 365 Defender. So now I'm in Microsoft 365 Defender. This is the unified portal
that we've been building for all Microsoft 365
security experiences. And we can see Defender
capabilities for Endpoints, as well as email and collaboration, and it's been integrated
with signal from identity and cloud app security. The Incident Overview
page we're looking at here shows us the most important
data points about this incident. We can see the scope of the attack with impacted devices,
users, and mailboxes. And if I scroll down, I can
see a detailed attack timeline. So here we're just showing
the one linked incident, but to get a broader perspective, I can hop up a level to
see all active incidents. We automatically correlate
related incidents, and the system does a lot
of the manual work for you. It helps you prioritize
incidents at a glance with information like
incident severity or category, impacted entities,
including devices, users, and mailboxes, and any tags assigned by the security team to
help give more context. - Okay, so if you're
one of our SOC analysts that are watching, this
makes it a lot easier than to sift through the noise and really find out what's important. - Yeah, it's back to those
seconds and minutes matter. It saves a bunch of
time and manual effort. So now let's go back to our
incident and look at the alerts. Here's everything we've
observed for this attack, all nicely correlated together. There's our malicious email that started it all with Phish detections, followed by multiple alerts for endpoint activities
on compromised devices. There's our process
injection to run Mimikatz, and then the sensitive credential read for our domain admin account and domain controller sync attack. I can see the ADFS compromise and the unusual addition
of OAuth app credentials, and finally anomalous email access. So let's click into this alert
with the threat experts tag, and you'll see that our
Microsoft security experts have already identified
this incident as critical and provided the SOC more
context about the attack. So we can see that it's
linked to the Nobelium attack. There's a timeline of observed events, recommendations with details
for how to respond to it, top indicators of compromise, along with advanced hunting
queries to find out more. At the top, I can see the
initially compromised device, workstation6, and our effected user, our Vice President Lucho Rodriguez, along with the full execution sequence. Now let's drill into
this one from PowerShell, and I can see it's downloading and executing a script from the web. And let's look at the
PowerShell script itself. You'll see it's obfuscated
and totally unreadable. So not even Jeffrey Snover would be able to tell
what's going on here. Luckily, through our AMSI integration, we can view the de-obfuscated
syntax for this, and actually see the
script that got executed and see it calling and
executing Mimikatz in memory. - So Rob, I don't think you're giving Jeffrey enough credit here in terms of that script, but now we've got Mimikatz running and the attacker is then able
to access more credentials and all this is bad. - They can. So now let's see how far they got. Back in the incident, I can see the ADFS private
key extraction alert from one of our servers. So it's important to not only
protect your user devices with Defender for Endpoint, but many times the servers
are the crown jewels of your organization. In fact, let's drill into our ADFS server. Remember, this is the key
piece of infrastructure that links our on-prem
environment to the cloud. So we'll see a unified
view of device details along with user log on
information from the last 30 days, and a detailed timeline
of recent activities, including a couple of suspicious events. The nice thing here is that the SOC analyst can
take actions directly from here, like isolating the device
until investigation and remediation completes. - Right, and we had some
compromised user accounts. So what about those? - We can take care of that too. Let's go back to our incident. I'll go to the Users tab with everyone impacted by this attack. You can see they went straight to the top of the organization and targeted our executives,
including our VP and CIO. You'll also see the ADFS admin accounts, and I can click into its details
and take action here too, like suspending the account or confirming the user was compromised, which is a flag for Azure
AD conditional access to block authorization. And like we saw on Azure Sentinel, from here I can also go
hunt for similar activities just in case this isn't
an isolated incident. It's the same KQL query language like I showed before in Azure Sentinel. And there are a bunch of
great samples to get started. So it's the same backend
and view in the cloud. And as you'll see in this case, I can run the same exact hunting query we ran earlier in Sentinel. And I've saved it to my queries. I'll go ahead and open it. And if I run it for the last 30 days, you'll see identical results to what we saw in Azure Sentinel. It's really two different views on the same brain in the cloud. Finally, as our SOC analysts
execute recommended actions, their actions and anything
automated by the system can be monitored in the Action Center, so you can track how we're doing
on remediating this attack. - Alright, so now we've gone
through the investigation and we've taken some remediation
steps, but what's next? - So once we're done investigating and remediating this incident, we can zoom out and look at
the organizational level. Here in threat analytics, new reports are published into the portal whenever a new threat or campaign emerges. Let's search for this
particular Nobelium attack. And I get a nice overview
of what's going on, like whether I have any
active alerts for it in my organization along
with impacted assets. In the analyst report,
there's even more details, including the anatomy of the attack, motivations of the attack group, a great visualization showing
the sequence of events with even more drilled down content as you read through the report. And this level of insight will help you to build the resilience and muscle to respond to future attacks. It's really that connection from the Microsoft security research team into your security team. - Got it, but before we close though, we saw that this particular
attack actually started out at the endpoint. So what happens then if users
are on unmanaged devices that we can't see because they
aren't logging up information to Microsoft 365 Defender? - You're right, not all
devices might be known or are already directly under
your management and control. And so to address this,
we've created a new mechanism to do device discovery across platforms. You start in Device Inventory in Microsoft Defender for Endpoint, which is where you can
find out the onboarding and health status of the
devices in your environment. We support a wide range of devices, including various versions
of Windows, as well as Linux, macOS, and even iOS and
Android operating systems. This has been part of
our Microsoft journey to make sure that we
protect all the things that you care about. Additionally, Device Discovery then lets your managed devices detect
the network around them and discover unmanaged devices, so you have a full view
of any onboarding gaps and can classify even a variety
of enterprise IoT devices, like we see here with this
unexpected Raspberry Pi device. And this can extend to
printers, smart TVs, and even fish tank thermometers, as long as they are connected
to the corporate network. Of course, great IoT protection works with Azure Defender for IoT. And we'll talk about that
more in upcoming months. - Thanks so much, Rob. And, of course, all of this
really shows the advantage of using the cloud to make sure that you have the latest defenses and threat analytics in place. - Look, attackers are
constantly upping their game and we need to as well. It takes all of us working together and all of us pushing much, much harder to protect our customers,
employees, and data. - Right, and as we've all seen, especially in the last 18 months, things have been particularly bad, but where can people go to learn more? - Well to learn more
about our integrated SIM and XDR solution with Azure Sentinel and Microsoft's Defender
solutions, check out aka.ms/XDR. Try out SimuLand, which is an open source
initiative from Microsoft, where we deploy a lab environment that reproduces the techniques used in real attack scenarios,
like the one you saw today, and shows you how our
solutions help you detect and respond to them. And, of course, keep implementing a Zero
Trust security model. This is going to give you
the best starting point to reduce your attack surface, take a proactive approach
to your organization and start you on the journey for making sure your whole environment is becoming more and more secure. - And speaking of Zero Trust, you know, we just completed a whole series of implementing the Zero
Trust security model that you can watch right now
at aka.ms/ZeroTrustMechanics. - I watched every second of
them and they were great. - Glad to hear it. So also keep following Microsoft Mechanics for the latest tech updates. Subscribe to our channel
if you haven't yet, and thanks so much for watching. (upbeat music)
