Author Archives: jstocker

Use PowerShell to Connect to Exchange Online unattended in a Scheduled Task

If you have MFA enabled, how do you connect to Exchange Online in an unattended script, like a Scheduled Task? Some people may have embedded a password into their scripts, but that will stop working in mid 2021 when Microsoft retires basic authentication in Office 365.

Microsoft has a preview version of Exchange Online v2 PowerShell that allows you to use a Certificate to authenticate.

Why Certificates? Because you don’t want an MFA push notification on your iPhone every morning at 1:00 AM, right?

Recommendation: Review to see if you have any automated scripts connecting to Exchange Online (typically scheduled tasks).

How? Follow the steps below to use certificates to connect to Exchange Online PowerShell

Prerequisites

Install-Module ExchangeOnlineManagement -RequiredVersion 2.0.3-Preview

Or if you already have a previous version of the module installed:

Update-Module ExchangeOnlineManagement -RequiredVersion 2.0.3-Preview

Note: If you get an error “A parameter cannot be found that matches parameter name ‘AllowPrerelease’” then run this command
Install-Module PowershellGet -Force (then close and re-open PowerShell)

Instructions

  1. Register an app in Azure AD (here).
    (The app is the entry point to Exchange Online PowerShell because it creates a service account called a service principal to perform administrative actions)
    image
  2. Click API Permissions on left navigation > Add a permission
    image
  3. Scroll to the bottom of the Request API permissions pane and click on Exchange under the Supported legacy APIs section.
    image
  4. Click on Application permissions
    image

  5. Expand the Exchange entry, and select the Exchange.ManageAsApp permission.
    Click the
    Add permissions button below to complete the operation.
    image
  6. Click “Grant Admin consent for your tenant”
    image
  7. Create a Role to assign to the App (Thanks to Tony Redmond for this tip)

$ExoAppSp = (Get-AzureADServicePrincipal -Filter “DisplayName eq ‘Exchange Online Scripting'”).ObjectId

$ExoRoleId = (Get-AzureADDirectoryRole | ? {$_.DisplayName -eq “Exchange Service Administrator”}).ObjectId

Add-AzureADDirectoryRoleMember -ObjectId $ExoRoleId -RefObjectId $ExoAppSp

  1. Create a self-signed X.509 certificate that will be used for authentication
    New-SelfSignedCertificate -Subject “Exo Background Process” -CertStoreLocation “cert:\CurrentUser\My” -KeySpec KeyExchange -FriendlyName “For EXO V2 Background Jobs”
  2. Open MMC, add Certificates, Find the new Cert, and Export it *without* the private key, as a .CER file.
    image
  3. Upload this file to the app you registered in the Azure Portal
    image

After adding the certificate, we need three items before we can finally connect unattended with PowerShell

  • The AppId of the application you created.
    Get-AzureADApplication -Filter “DisplayName eq ‘Exchange Online Scripting'”
  • The thumbprint of the certificate loaded into the app
    Get-ChildItem -path ‘Cert:\*’ -Recurse |where {$_.Subject -like ‘*EXO*’}
  • The service domain for your tenant (like tenant.onmicrosoft.com).

With these values, you can connect to Exchange Online using certificate-based authentication with a command like:
Connect-ExchangeOnline -CertificateThumbprint ” 960BD967A9287CE83DF4138805B5CE2FCA4C9B8B” -AppId “b83c46c6-044e-40e5-929c-634f80045a11” -ShowBanner:$false -Organization tenant.onmicrosoft.com

References

· Microsoft Documentation

· Vasil Michev

· Tony Redmond: Office 365 IT Pros

What happened to Defender running in a Sandbox? MP_FORCE_USE_SANDBOX

A colleague asked me today “Does Microsoft Defender run itself in a sandbox by default, or does that need to be manually enabled?”

He was referring to a breakthrough feature first announced (here) two years ago (10/26/2018)

We all know Defender can detonate files in a cloud sandbox – but we are talking about Defender running *itself* (MSMPENG.EXE) inside a sandbox.

This was a big deal at the time it was announced, because Defender was the first Antivirus product to run *itself* in a sandbox. I had read reports that 30% of all malware targeted security software since it runs with such high privileges, so this was and is a very big deal.

Running Windows Defender Antivirus in a sandbox ensures that in the unlikely event that Defender itself has vulnerabilities and becomes compromised, malicious actions are limited to the isolated environment, protecting the rest of the system from harm, since Defender runs with such high system privileges.

This feature is enabled with a machine-wide environment variable (setx /M MP_FORCE_USE_SANDBOX 1) and then restarting the machine (System requirement: Windows 10, version 1703 or later)

How can I tell if Defender is running itself in a Sandbox? Check task scheduler and if you see “CP.exe”

clip_image002

Sysinternals will show “App Container” 

clip_image004

You can also run CMD.exe followed by the SET command by itself to see if the environment variable is present:

image

So the question is, has Microsoft now built this into the operating system by default?

I created some fresh Win10 VM’s with Defender and did not see the CP.exe tailing process name.

So my big question is: why after two years hasn’t it been turned on by default? Is Microsoft aware of any risks or problems when this is enabled? And why is there no MEM/Intune configuration to enable this setting?

Defending against Pass-the-PRT

The Azure AD Primary Refresh Token (PRT) can be extracted using ROADtools, written by security researcher Dirk-jan Mollema and recently weaponized into Mimikatz by Benjamin Delpy.

With local Administrator privileges it becomes possible to extract the PRT and the required cryptographic material to sign in on any Azure AD connected resource with the account to which the PRT was issued. The PRT is valid for 14 days and can be used on any device in this time-frame. Any MFA claims that were assigned to the PRT remain valid as well.

It’s important to understand exactly how this attack works so that you can test your defenses against it. You should never assume that your defenses are adequate. Just like a backup is not good unless it is restored, your defenses are not good unless you test them frequently and thoroughly.

A PRT is only issued to native apps (like the full Outlook client) on Azure AD Registered, Azure AD Joined, or Hybrid Azure AD joined devices. A browser session on a workgroup machine will not receive a PRT. To learn more about how PRT’s are issued, see this article: https://docs.microsoft.com/en-us/azure/active-directory/devices/concept-primary-refresh-token

The attacker runs a few mimikatz commands:

privilege:debug
sekurlsa::cloudap

cloudap1

The PRT can then be imported into Chrome as a cookie:

image

And this allows the attacker to sign in as the user, even if their device is not Intune compliant or Hybrid Azure AD joined.

Defending against Pass-the-PRT

There are ~15 Attack Surface Reduction Rules (ASR) in Windows 10. The following rule can be enabled in Audit or Block mode. We strongly recommend Audit mode first because Block mode may block legitimate processes that you will need to exclude before deploying this in production. On a single test machine you can run this command for audit mode:

Add-MpPreference -AttackSurfaceReductionRules_Ids 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2 -AttackSurfaceReductionRules_Actions AuditMode

And this command for block mode:

Add-MpPreference -AttackSurfaceReductionRules_Ids 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2 -AttackSurfaceReductionRules_Actions Enabled

And when this ASR rule is enabled, we can see that Mimikatz is unable to dump the PRT

image

Normally this should get logged as Event 1121 (Block) or 1122 (Audit) in the Event Viewer: Microsoft-Windows-Windows Defender/Operational

Or if you have Microsoft Defender ATP then in the Timeline view you can filter on ASR Events:

image

Recommendations

1. Do not grant users local administrator privileges

2. Enable Tamper Protection in Windows Defender. It is more difficult for Mimikatz to run when Defender AV is running.

3. Enable Attack Surface Reduction Rules (ASR)  to block access to LSASS.exe

Switch from ADFS to Azure AD

A surprising number of clients are still operating complex ADFS farms.

ADFS Complexity 

Here are 8 reasons to switch to Azure AD.

1. ADFS has a greater surface attack area than Azure AD. Example: NTLM Brute-Force (CVE-2019-1126).

2. ADFS can have multiple single points of failure unless designed properly

3. ADFS requires certificate maintenance – resulting in planned downtime

4. ADFS requires lots of IT overhead (Backups, Monitoring, OS Upgrades, etc)

5. Azure AD Conditional Access offers better security controls than ADFS Claims

6. Azure AD is lightweight and less complex to administer (No Claims Rules)

7. Azure AD more closely aligns to NIST 800-63b (Scan for breached passwords)

8. Azure AD has a better feature roadmap

It’s easy to switch from ADFS to Azure AD. For example, this one PowerShell command can migrate Office 365 from ADFS to Cloud in less than 5 minutes. Set-MsolDomainAuthentication -DomainName mydomain.com -Authentication Managed

You can also do a staged rollout of smaller groups at a time rather than a big bang cutover using (the first security group is limited to 200 users). Learn more about staged rollout (here).

Note: That’s the core command that moves the trust from ADFS to Azure AD. There are more planning steps involved like making sure you have enabled password hash sync. Learn more planning steps (here).

Here are 5 tips for moving other apps from ADFS to Azure AD

  1. Use the new ADFS Application activity report (preview) or the ADFS to Azure AD app migration tool to analyze your current apps. This tool will quickly identify which apps can be migrated seamlessly and which require remediation (see figure one).
  2. Acquire deployment guides for the relevant apps. Many are published on the Microsoft app gallery, but if not, you can open a ticket through the third-party vendor who developed the app.
  3. Allocate appropriate time and resources to the high-touch apps.
  4. Migrate the apps that are ready to go for quick wins.
  5. Identify a test environment or plan a maintenance window to avoid moving large servicing app at peak usage.

Learn more here:

https://techcommunity.microsoft.com/t5/azure-active-directory-identity/five-tips-to-improve-the-migration-process-to-azure-active/ba-p/445364

What is Double Key Encryption (DKE)?

Today Microsoft announced the public preview of Double Key Encryption (DKE).

What does “Double Key” mean? It’s similar to a missile launch where two people must turn their key at the same time. In the case of encryption, it is the combination of two keys held by separate parties that encrypt or decrypt data.

DKE

Or to quote Microsoft:

“Double Key Encryption enables you to protect your highly sensitive data while keeping full control of your encryption key. It uses two keys to protect your data—one key in your control, and a second key is stored securely in Microsoft Azure. Viewing data protected with Double Key Encryption requires access to both keys. Since Microsoft can access only one of these keys, your protected data remains inaccessible to Microsoft, ensuring that you have full control over its privacy and security.”

Your Client Key is hosted outside of Microsoft (wherever you want) via a web service that you are responsible for hosting. If your web service goes down (intentionally or unintentionally) then no new data can be encrypted or decrypted.

This is similar to its predecessor, Hold-Your-Own-Key (HYOK) which I assume DKE will eventually replace at some point in the future. Except there is one big advantage: Unlike HYOK, DKE does not depend upon on-premises Active Directory Rights Management Services (AD RMS). So it is a simpler configuration.

Is DKE right for me? Most likely not. It’s intended for some super rare scenarios that very few clients have. There are serious productivity limitations to DKE that are nearly identical to HYOK, where many features inside Office 365 and other services will not function such as SharePoint Search, eDiscovery Search, Data Loss Prevention, Transport Rules, Exchange ActiveSync, Journaling, Malware scanning, Archiving Solutions and any other services that needs to read data such as 3rd party document management systems.

Therefore customers should carefully evaluate all key options before proceeding with DKE (see table below).

What if I lose my key? Your data is inaccessible, and there is no ‘back door’ key like the ‘Availability Key’ feature in BYOK that allows Microsoft to decrypt data if you lose your BYOK key.

Encryption Key Comparison

HYOK

(Hold-Your-Own-Key)

Double-Key Encryption (NEW)

BYOK
(Bring-Your-Own-Key)

Microsoft

Managed Key

Can Microsoft Read the Encrypted Data?

No

No

Yes

Yes

AD RMS Required?

Yes

No

No

No

100%Cloud Hosted

No

No

Yes

Yes

On-Prem or Cloud
DMZ Req?

No

Yes

No

No

On-Prem
HSM Req?

Yes

Yes

Yes

No

ActiveSync Support

No

No

No

No

Exchange On-Premises IRM

No

No

Yes

Yes

Outlook Mobile

No

No

Yes

Yes

OWA

No

No

Yes

Yes

Office Mobile

(Word/Excel/PPT)

Yes (Consume Only)

Yes (Consume Only)

Yes

Yes

Mac OSX

Yes (Consume Only)

Yes (Consume Only)

Yes

Yes

SharePoint Search

No

No

Yes

Yes

Key Strength

RSA 2048-bit (Key Exchange)

AES 128 (Wrapping)

SHA 256 (Signing)

(FIPS 140-2)

RSA 2048-bit (Key Exchange)

AES 128 (Wrapping)

SHA 256 (Signing)

(FIPS 140-2)

RSA 2048-bit (Key Exchange)

AES 128 (Wrapping)

SHA 256 (Signing)

(FIPS 140-2)

RSA 2048-bit (Key Exchange)

AES 128 (Wrapping)

SHA 256 (Signing)

(FIPS 140-2)

External Collaboration

No

No

Yes

Yes

Office Client Support

Office 2013 +

Office Insider*

Office 2013 +

Office 2010 +

Auditing

Yes

Yes

Yes

Yes

Office Insider is required at the time of this writing (July 2020) but eventually it will roll out to Office versions in mainstream support.

Initially at the time of this writing, the AIP Unified Labeling Client is required to encrypt/decrypt content. It will eventually be available natively in the Office Ribbon.

Additional Resources

Blog Post: https://aka.ms/DKEpreview
Deployment Docs: https://aka.ms/DKEpreviewdocs
Github Repo: https://aka.ms/DKErepo

July 2020 Major Vulnerability Roundup

Palo Alto CVE-2020-2021

If you have SAML enabled on your Palo Alto, a CVE Severity 10 Critical vulnerability allows remote unauthenticated access
https://security.paloaltonetworks.com/CVE-2020-2021

Citrix (Multiple CVE’s)

Multiple vulnerabilities in the Citrix Application Delivery Controller (ADC) and Gateway would allow code injection, information disclosure and denial of service, the networking vendor announced Tuesday. Four of the bugs are exploitable by an unauthenticated, remote attacker.

https://threatpost.com/citrix-bugs-allow-unauthenticated-code-injection-data-theft/157214/

F5 (CVE-2020-5902)

If you have F5, and haven’t patched, treat it as incident response at this point as public exploits are available. There was also a new bypass discovered.

Chrome

Google is rolling out an important software update for Chrome browser—version 83.0.4103.106 for Windows, Mac, and Linux—that includes security patches for 4 high-severity vulnerabilities.

SAP (CVE-2020-6287)

A new critical vulnerability, carrying a severity score of 10 out of 10 on the CvSS bug-severity scale, was found in SAP impacting 40,000 customers. At least 2,500 customers in the United States that have internet facing SAP are impacted.

According to an alert from the Department of Homeland Security, successful exploitation of the bug opens the door for attackers to read and modify financial records; change banking details; read personal identifiable information (PII); administer purchasing processes; sabotage or disrupt operations; achieve operating system command execution; and delete or modify traces, logs and other files.
https://threatpost.com/critical-sap-bug-enterprise-system-takeover/157392/

Cisco CVE-2020-3297

The flaw ranks 8.1 out of 10.0 and could allow remote, unauthenticated attackers to access the switches’ management interfaces with administrative privileges.

https://threatpost.com/cisco-warns-high-severity-bug-small-business-switch/157090/

Microsoft

AVANAN announced “SYLKin Attack” which claims to bypass M365 security.

You can block .SLK attachments with the Set-MalwareFilterPolicy PowerShell command, or Exchange transport rules.

Patch Tuesday (7/14/2020) included a fix for a wormable RCE vulnerability in Windows DNS that should be patched ASAP. (CVE-2020-1350)

Microsoft pushed out two emergency security updates to fix remote code execution bugs in Microsoft Windows Codecs Library.

These patches come weeks after Microsoft’s regularly scheduled June Patch Tuesday, where it released patches for 129 vulnerabilities – the highest number of CVEs ever released by Microsoft in a single month. Within the blockbuster security update, 11 critical remote code-execution flaws were patched in Windows, SharePoint server, Windows Shell, VBScript and other products. Unlike other recent monthly updates from Microsoft, its June updates did not include any zero-day vulnerabilities being actively attacked in the wild.

Using Intune to Deploy MDATP to Mac OSX in 7 clicks

Got Mac OSX? Are they enrolled into Intune? If so, then deploying Microsoft Defender ATP (MDATP) to these devices is done in 7 easy clicks.

Start off by browsing to Microsoft Endpoint Manager at https://endpoint.microsoft.com

image

image

image

image

Yes, that was easy, however, the fine print is you first must deploy a kernel extension profile *BEFORE* the 7 steps above, otherwise the user will see “System extension blocked.”

If for some reason you missed that step, users must approve the extension manually by going to Security Preferences > Security & Privacy on the Mac and select Allow.

Other helpful scripts and tips are available on the Microsoft blog (here).

Fortune 500 Email Security Vendor Market share

Which email security vendors are gaining or losing market share? About a year ago I wrote an article (here) detailing how to use PowerShell to crawl the public DNS records of the Fortune 500.

So 12 months later, Microsoft has decreased 12% and Proofpoint has increased 12%. Cisco also had an 18% increase in market share. 

image

MDATP and THOR–A Powerful combination

Microsoft Defender Advanced Threat Protection (MDATP) is an extended detection and response (XDR) solution, a kind of SHIELD, that combines protection for endpoints (Microsoft Defender ATP), email and productivity tools (Office 365 ATP), identity (Azure ATP), and cloud applications (Microsoft Cloud App Security/MCAS), and many 3rd party solutions like Nextron Systems THOR APT Scanner. As customers face attacks across endpoints, cloud, applications and identities, MTP looks across these domains to understand the entire chain of events, identifies affected assets, like users, endpoints, mailboxes, and applications, and auto-heals them back to a safe state.

Basically, it’s very similar to how S.H.I.E.L.D needs the Avengers to carry out missions. Do you see what I did there? (Thor is an Avenger).

This blog post is about the 3rd party aspect of the XDR when MDATP can tap into THOR to use 12,000 YARA rules from Nextron Systems.

How do you get your hands on YARA rules? Well, you can write your own, but that could take you years to map out all the known threats out there. Or you can purchase a tool like THOR from Nextron Systems, which integrates with their database of 12,000+ YARA rules. The strength of their particular rule set is that it focuses detecting APT threat groups, and over 1,500 web shells. Most EDR systems miss the web shells that these YARA rules detect.

Nextron has previously published their integration capabilities with MDATP on their blog (here) and I highly recommend you check it out.

Screenshot-2020-04-21-at-13.36.06

In this blog post, we are going to try out the newest integration from Nextron, which features their THOR Cloud scanner. This was EASY! From start to finish it took me less than 5 minutes. You simply download the PowerShell script from Nextron, which is generated to include the license key, upload that script into MDATP’s Live Response, and in less than one minute, get a report back on any matches that were found from the THOR scan. The default configuration, quick scan, can be modified to include additional modules such as Registry and Process, but this will increase the scan time from 1 minute to ~15 to 20 minutes. A scan of the entire file system and event log could extend the time to 40 minutes to 3 hours depending on the number of files and types of contents. I recommend getting started with quick scan first so you can see how it works. If you decide to make changes, here is a screen shot of the section of the script you can change:

image

Step 1. Obtain a license key from Nextron.

Note: This blog post will be updated with more details about an upcoming webinar in June, 2020 featuring Florian Roth (@cyb3rops)

Step 2. Launch MDATP Live Response Session

Note: As of April 6th, Live Response now runs on Windows 10 1709 or newer (it was previously only available on 1903 or newer). Make sure you have Live Response and Custom Scripts enabled in MDATP (they are off by default). You’ll need to enable, at least, the minimum Remediation Level for a given Machine Group.

SNAGHTML6827e8f

Upload the thor-seed.ps1 file that you obtained from Nextron.

image

image

image

The scan completed in just under one minute. Very fast, when you consider it used over 12,293 YARA rules!

image

It produced a handsome HTML report in C:\ProgramData\thor

image

I first ran this on a clean system to create a baseline, I wanted to make sure I didn’t get too many false positives on a machine I expected to be clean. It was very accurate, because it detected TOR but no other false indicators.

SNAGHTML68ee964

On another system I tried, it reported a file containing dumped password hashes, created from Gsecdump (developed by Johannes Gumbel).

SNAGHTMLf22b9ee

Here is an example of PSEXEC.exe being found even though it was renamed to 2.exe

SNAGHTMLf35552d

After the scan completes, it provides hints on the syntax to remotely retrieve the HTML report and detailed TXT files from the remote system, and then remove them with the remediate command.

SNAGHTML6ac3a46

If you run the scan twice, you need to first remove the prior HTML and TXT files. If you use the Remediate command, it will create a pop-up on the target machine that the file was removed.

image

Another interesting lesson I learned is that even if you delete the HTML report, if you download it a second time, Defender will still grab a cached copy from the first download

SNAGHTMLf37d83e

I believe adding the timestamp to the file name should eliminate this cache problem.

Overall, I would highly recommend this whenever you are investigating a threat with MDATP because many of these YARA rules detect threats that are not yet found in VirusTotal. These YARA rules from Nextron effectively extend the MDATP detection capabilities as shown below. For example, the presence of TOR.exe, PSEXEC.exe, or the LM Hash dump from Gsecdump were not flagged as alerts inside MDATP EDR.

image

Also, check out the latest MITRE evaluation of MDATP against the Russian Hacking Group “Fuzzy Bear” aka APT 29 (here).

Conditional Access with Hybrid Domain Join requires browser extension for Chrome

For Chrome to be compatible with Azure AD conditional access security policies that check for Hybrid Domain Join, you must install a Browser extension from (here) *or* deploy a registry key from (here).

This is because Chrome does not pass the Hybrid Domain Join status, as shown below:

Chrome

IE or Edge

clip_image002

clip_image004

Adding the browser extension or registry keys allows a user to use Chrome to access the SSO via conditional access policy.

Otherwise you will get an error “You can’t get there from here”

image