What we Learned from Sunburst with Zero Trust

2020 CROWDSTRIKE, INC. ALL RIGHTS RESERVED.
WHAT WE LEARNED ABOUT
ZERO TRUST FROM SUNBURST
ANDREW HARRIS,
SR. DIRECTOR, PUBLIC SECTOR TECH STRATEGY
@CIBERESPONCE

1 Indicators of Attack (IoA’s)
2 Service Accounts, Helpdesk/IT Admins
3 On-Premises to the Cloud (bypassing MFA)
4 Evicting the adversary?... Not so easy
5 Mission Resiliency
WHAT WE LEARNED
Or rather, what’s now impossible to ignore…

Steps
QUICK REVIEW OF SUNBURST
E
s
t
a
b
l
i
s
h
e
d
T
r
u
s
t
A
D
F
S
—
A
A
D
(
S
A
M
L
2
.
0
)
AD FS
1
5
2
3
Supply-chain
Server
4
IdP
Adversary C2
What the tactics, techniques and procedures taught us, or… reminded us
3
Harvest AD FS Private Key
(“Golden SAML”)
2 Lateral Movement to AD FS
1
Supply-chain Server
compromised
4 “Golden SAML” Exfiltration
5
Access Azure AD/Office 365
using “Golden SAML”-signed
tokens

SUNSPOT’S IOA

ON-PREMISES IDENTITY
§ Service Accounts are typically targeted in campaigns as they predictably have
privileges across many systems
§ 27% of all credentials are service or programmatic accounts
§ Over 80% of all logon-types are non-interactive
§ Most US Governments leverage PKI, use of SmartCards, and leverage a setting
called Smart Card Required for Interactive Logon (SCRIL) with Active Directory
(AD) to force SmartCard use for certain user populations
§ This is only useful for Interactive Logons, meaning PowerShell, Windows Management
Instrumentation (WMI) and other protocols aren’t applicable to these policies
§ Identity Providers only MFA for Cloud authentication requests!
And the blind-spots with Service Accounts and even our Helpdesk and IT Admins
We are therefor, mostly blind or have less confidence in non-interactive logons—where majority
of us can’t MFA for these vast majority of use cases. It’s technically impossible unless we can
enforce policy in AD beyond Microsoft’s stack.

GAINING CONTROL ON OUR IDENTITY
Account Type Non-interactive
(Batch, Scheduled Task,
etc)
Interactive
(RDP, Domain Logon, etc.)
Human X X
Service Account X
§ Service accounts should:
§ Never be used interactively; if they are, they are grossly misconfigured are being used
inappropriately in post-exploit activity
§ Human/people accounts should:
§ Be challenged via MFA for interactive logons
§ Be challenged via MFA for non-interactive logons (i.e. PowerShell, WMI, etc.)
§ There are legitimate use-cases here, such as administrating servers and other infrastructure
§ Via SmartCard’s and “SCRIL”, this is technically unviable to implement
Increasing confidence including on-premises

CROWDBOARD

Sketch of AD + Application
Video recording

EVICTING AN ADVERSARY WITH A CIRCULAR
LOOP OF CONTROL
Active Directory
(application)
Operating System
Cloud Virtual Fabric
Global
Admin
backdoor
account 3
Active Directory Federation
Service (Golden SAML)
1 impacted supply
chain service
account
2
no security
boundary
no security
boundary
Cloud
On-Premises
Back
door
Back
door

Measuring Cloud Security Posture Management, now including Azure AD
CROWDSTRIKE HORIZON
For CrowdStrike Horizon customers,
let us help you find these egregious
permissions in AAD within the
Falcon Console!

Achieving Mission Resiliency
Mission Resiliency
through Zero Trust
Architecture Principles
Secure Exposed Credentials on
Endpoints
02
C
l
o
u
d
S
e
c
u
r
i
t
y
P
o
s
t
u
r
e
M
a
n
a
g
e
m
e
n
t
(
C
S
P
M
)
,
C
l
o
u
d
W
o
r
k
l
o
a
d
P
r
o
t
e
c
t
i
o
n
(
C
W
P
)
,
C
I
/
C
D
I
n
t
e
g
r
a
t
i
o
n
s
03
01
S
e
c
u
r
e
O
n
-
P
r
e
m
i
s
e
s
I
d
e
n
t
i
t
y
01
02
03
On-Premises Identity Visibility and Control
(Falcon IDP)
Future-proof: Zero Trust applied on-
premises; Visibility into most targeted
accounts (ref Sunburst)
Secure, Hardened Endpoints (Falcon EPP)
Future-proof: Zero Trust signal (vulns.,
incidents, hygiene)
Measure, Secure & Hardened Cloud and
DevSecOps
Future-proof: Zero Trust driven conditional
accesses, especially for critical control and
identity-plane functions—including your
CI/CD pipelines

GET MORE INFORMATION
For more information please refer to:
§ www.crowdstrike.com/blog/tech-
center/assess-sunburst
§ www.crowdstrike.com/sunburst
Need Incident Response or Compromise
Assessment support?
§ www.crowdstrike.com/services
§ services@crowdstrike.com
@CIBERESPONCE

What we Learned from Sunburst with Zero Trust

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to What we Learned from Sunburst with Zero Trust

Similar to What we Learned from Sunburst with Zero Trust (20)

Recently uploaded

Recently uploaded (20)

What we Learned from Sunburst with Zero Trust