# Remediation and Hardening Strategies for Microsoft 365 to Defend Against UNC2452 **fireeye.com/blog/threat-research/2021/01/remediation-and-hardening-strategies-for-microsoft-365-to-defend-against-** unc2452.html ## Breadcrumb Threat Research Mike Burns, Matthew McWhirt, Douglas Bienstock, Nick Bennett, Juraj Sucik Jan 19, 2021 5 mins read TTPs Uncategorized Groups (UNC Groups) ----- Threat Research _[UPDATE (May 2022): We have merged UNC2452 with APT29. The UNC2452 activity](https://www.mandiant.com/resources/unc2452-merged-into-apt29)_ _described in this post and report is now attributed to APT29._ _UPDATE (Oct. 28, 2021): Mandiant has recently observed targeted threat actors using EWS_ _impersonation (via the ApplicationImpersonation role) to maintain persistent access to_ _mailboxes in victim environments. Once the threat actor has access to this role, its abuse is_ _hard to detect and provides the threat actor control over every mailbox in a victim_ _tenant. Mandiant has also observed targeted threat actors abusing the trust relationship_ _between Cloud Service Provider (CSP) organizations and their customers to laterally move_ _from service providers to their downstream customers and gain administrator privileges in_ _the target tenants. The blog post, white paper, and Azure AD Investigator tool have been_ _updated to reflect these findings._ _UPDATE (Mar. 18): Mandiant recently observed targeted threat actors modifying mailbox_ _folder permissions of user mailboxes to maintain persistent access to the targeted users'_ _email messages. This stealthy technique is not usually monitored by defenders and provides_ _threat actors a way to access the desired email messages using any compromised_ _credentials. The white paper, blog post and Azure AD Investigator tool have been updated to_ _reflect these findings. Mandiant would like to thank the members of Microsoft’s Detection and_ _Response Team (DART) for their collaboration on this research._ In December 2020, FireEye uncovered and publicly disclosed a widespread attacker [campaign that is being tracked as UNC2452. In some, but not all, of the intrusions](https://www.fireeye.com/resources/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor) associated with this campaign where Mandiant has visibility, the attacker used their access to on-premises networks to gain unauthorized access to the victim’s Microsoft 365 environment. **Goals and Objectives** Methodologies that UNC2452 and other threat actors have used to move laterally from onpremises networks to the Microsoft 365 cloud have been detailed in our white paper, _[Remediation and Hardening Strategies for Microsoft 365 to Defend Against UNC2452. The](https://www.mandiant.com/media/13006/download)_ paper also discusses how organizations can proactively harden their environments and remediate environments where similar techniques have been observed. [Mandiant is releasing an auditing script, Azure AD Investigator, through its GitHub repository](https://github.com/mandiant/Mandiant-Azure-AD-Investigator) that organizations can use to check their Microsoft 365 tenants for indicators of some of the techniques used by UNC2452. The script will alert administrators and security practitioners to artifacts that may require further review to determine if they are truly malicious or part of legitimate activity. Many of the attacker techniques detailed in the white paper are dual-use in nature—they can be used by threat actors but also by legitimate tools. Therefore, a detailed review for specific configuration parameters may be warranted, including correlating and verifying that configurations are aligned with authorized and expected activities. ----- **Attacker Tactics, Techniques and Procedures (TTPs)** Mandiant has observed UNC2452 and other threat actors moving laterally to the Microsoft 365 cloud using a combination of five primary techniques: 1. Steal the Active Directory Federation Services (AD FS) token-signing certificate and [use it to forge tokens for arbitrary users (sometimes described as Golden SAML). This](https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps) would allow the attacker to authenticate into a federated resource provider (such as Microsoft 365) as any user, without the need for that user’s password or their corresponding multi-factor authentication (MFA) mechanism. 2. Modify or add trusted domains in Azure AD to add a new federated Identity Provider (IdP) that the attacker controls. This would allow the attacker to forge tokens for [arbitrary users and has been described as an Azure AD](https://o365blog.com/post/aadbackdoor/) [backdoor.](https://www.fireeye.com/resources/detecting-microsoft-365-azure-active-directory-backdoors) 3. Compromise the credentials of on-premises user accounts that are synchronized to Microsoft 365 that have high privileged directory roles, such as Global Administrator or Application Administrator. [4. Backdoor an existing Microsoft 365 application by adding a new application or service](https://dirkjanm.io/azure-ad-privilege-escalation-application-admin/) principal credential in order to use the legitimate permissions assigned to the application, such as the ability to read email, send email as an arbitrary user, access user calendars, etc. 5. Modify the permissions of folders in a victim mailbox (such as the inbox) to make its contents readable by any other user in the victim’s Microsoft 365 environment. 6. Use EWS Impersonation to impersonate any mailbox owner in the Microsoft 365 tenant and bulk collect mail items. 7. Target and compromise Cloud Service Providers (CSPs) that have permissions to administer customer tenants of organizations that UNC2452 is targeting, and abuse the access granted to the CSP to perform post-compromise activities against the target organization. Read the [white paper for a detailed overview of each technique, including practical](https://www.mandiant.com/media/13006/download) remediation and hardening strategies, and check out our auditing script, Azure AD Investigator. **Detections** **FireEye Helix Detection** **MITRE** **Technique** **Detection Logic** MICROSOFT AZURE ACTIVE DIRECTORY [Risky Sign-In] [T1078.004](https://attack.mitre.org/techniques/T1078/004/) Alert on suspicious logon activity as detected by Azure Identity Protection ----- OFFICE 365 [Federated Domain Set] OFFICE 365 [Modified Domain Federation Settings] OFFICE 365 [User Added Credentials to Service Principal] OFFICE 365 ANALYTICS [Abnormal Logon] WINDOWS METHODOLOGY [ADFS Dump] OFFICE 365 [Mailbox Folder Permission Change – Inbox and Top Of Information Store] [T1550](https://attack.mitre.org/techniques/T1550/) Alert on new domain federation in Office 365 [T1550](https://attack.mitre.org/techniques/T1550/) Alert of modification to domain federations settings in Office 365 [T1098.011](https://attack.mitre.org/techniques/T1098/001/) Alert on addition of certificates or passwords added to Service Principals [T1078.004](https://attack.mitre.org/techniques/T1078/004/) Alert on suspicious login activity based on heuristics [T1098.002](https://attack.mitre.org/techniques/T1098/002/) Alert on suspicious modifications of mailbox folder permissions for the inbox or top of information store. [TA0006](https://attack.mitre.org/tactics/TA0006/) [T1552](https://attack.mitre.org/techniques/T1552/) [T1552.004](https://attack.mitre.org/techniques/T1552/004/) [T1199](https://attack.mitre.org/techniques/T1199/) Alert on activity access requests for the AD FS Distributed Key Manager (DKM) container in Active Directory -----