Identifying suspicious credential usage

The actions below draw from the NCSC's Identity and Access Management, Managing User Privileges (from our 10 Steps to Cyber Security) and Protecting Management Interfaces guidance. They all highlight the importance of:

1. Configuring accounts with the minimum level of privileges required to perform their role.
2. Subjecting privileged accounts to greater levels of auditing and scrutiny.
3. A joiners-movers-leavers process for active account management (noting that external suppliers and services will also join and leave organisations).

As atomic indicators, such as the malicious infrastructure or malware samples used can vary even between individual victims of the same threat actor, we recommend taking the following steps to identify potentially suspicious behaviours associated with the replay of compromised but legitimate credentials.

1.   Identify what privileged accounts exist in your environment, particularly (but not exclusively) those used by third party providers or vendors. Experienced users can use tools such as Bloodhound to identify accounts especially valuable to an attacker.

2.   Determine what ‘normal’ looks like, for those accounts, using sources such as existing logging or configuration documents. This will include:

•   typical access IP addresses (including those that are internal to your network and external)

•   typical source hostnames (where this data exists in your logging)

•   common working hours (frequency of use, and whether the activity is automated)

•   types of activity or systems accessed by those accounts

3.   Assess for activity outside of those expected norms.

4.   Reset or lock accounts where there is concern.

5.   Investigate for further compromise as a result of any accounts flagged as suspicious.

If you’re supporting a Microsoft environment, we also recommend you read their targeted advice for incident responders on recovery from systemic identity compromises.

Of course, most of us allow third parties some sort of access (especially with cloud services), so there are scant systems where credentials are only used by the organisation. Service/machine credentials are just as important as people’s. Monitoring for unusual use of credentials on your system not only helps you to mitigate insider risk and detect compromise of your own estate, it also helps you detect if someone in your supply chain has breached some of your credentials, as per the recent SolarWinds (and related to that, Mimecast) incidents.

Toby L
Technical Lead for Incident Management