As companies raise their bars and protect more and more accounts with Multi-factor Authentication the attacks are twisting with new angles. The method of using Application Consent is nothing new but attackers haven’t had a need to use it as a stolen password is normally less friction.
So what is Application Consent, Application consent is a way to grant permissions to Applications to access your data that they need to perform their specific Task. An example could be a be a Travel App that needs to read your Travel itinerary so that it can automatically update your Calendar with Flight Data or other information.
I am sure everyone has seen a App Consent Screen
Kevin Mitnick did a malicious Ransomware PoC roughly with Application Consent two years ago around this, feel free to watch the demo on the youtube link.
The first thing you should ask your selves, do you allow your users to Grant Permissions themselves of their data or have you as an organization centrally taken this control?
The settings can be configured under your Azure Active Directory
First off can your users Register Applications themselves or is this under central control?
AAD > User Settings > Enterprise Applications
So if you do not allow this the users would never be able to allow an App consent either, but if you do you can control how much data they can share and under what circumstances, you will find a few options in the detailed settings below.
AAD > Enterprise Applications > User Settings
AAD > Enterprise Applications > Consent and Permissions > User Consent Settings (Preview at the time of writing)
Do not allow user consent
Allow user consent for apps from verified publishers
Allow user consent for Apps
Allowing users to allow Apps will put you at risk as they can be lured into accepting an Application Consent. This is not only sensitive from a Security Threat perspective, but also from a privacy / secrecy perspective where third party apps malicious or not are for an example being granted access to PII or Customer Data.
Here you need to find the balance between control and risk on how much you can detect. With the “Allow user consent for apps from verified publishers” you also have the option to control what data and methods are being granted as well. Not that the offline_access is something you need to review thoroughly as that opens up your exposure.
Another possibility that exists is also to user a Admin Consent Requests, in this case a User can request a consent that an Admin will have to review and approve or deny.
AAD > Enterprise Applications > User Settings
Application Control Detection
There are a few ways to see and detect Application Consent, either you create a manual process to review this on a schedule or you use the tools you have at hand. Some examples on what you can use below depending on how you are licensed and how you have integrated Logs.
So what can you do if you find Applications that you suspect are doing malicious activities or is putting your data at risk.
You have a few options, start with documenting and putting a timeline with all the activities you are taking, its easy to forget when you need to go back in time.
Block Sign-in to Application
Remove Users from the Application
Remove the Application Completely
Ban/Block Application in MCAS
Review Permissions under the App in AAD
I wouldn’t recommend removing the app until your investigations is complete, id rather block the Login. Depending on that tools you have you can start going through your audit logs in relation to this app.
One thing we usually discuss with customers is the workload. Everyone has too much to do and it can, sometimes be difficult to prioritize investigations.
now, where you might be short on staff, and the Covid-19 virus can strike at
the SOC organization or reduce the numbers of available people.
this does not only apply during the world crisis of Covid-19. Automation is
also a help in the normal day to day work.
There are benefits
of being able to automate responses and we have these discussions with many
Automatic self-healing is built-in into Defender ATP and is mimicking these
ideal steps a human would take to investigate and remediate organizational
assets, impacted by a cyber threat.
done using 20 built-in investigation playbooks and 10 remediation actions
at the speed of automation
and remediate all alerts automatically
up critical resources to work on strategic initiatives
will drive down the cost per investigation and remediation
away manual, repetitive tasks
remediation eliminates downtime
value of your protection suite and people, quick configuration and you are up
SecOps Investigation (Manual)
it will take some time from the alert being triggered until someone has the
time to start looking at it. Manual work
also requires more resources for review and approval for each action
SecOPs perspective, an initial response involves information gathering.
Where did the file originate from?
our results, we will decide the remediation steps (if we do not follow a
playbook here, the catch will be different result depending on who makes the
remediation will include connecting remotely or manually collect the device and
then launch tools for the remediation process.
Automatic response with Auto IR
to respond which will avoid additional damage and compromise of additional devices,
when attackers will start moving lateral in the environment.
24/7 buddy who assists the SOC staff to remediate threats so the human staff can
focus on other things
MDATP is sending telemetry data to
MDATP cloud continuously analyzes
the data to detect threats
Once a threat is identitfied an
alert is being raised
The alert kicks off a new automated
AIRS component asks Sense client to
SenseIR is then orchestrated by AIRS
on what action should be executed (Collection/Remediation)
Based on the data collected from the
machine (current and historical) AIRS decides what actions should be taken
For every threat identified, AIRS
will automatically analyze the best course of action and tailor a dedicated
surgical remediation action to be executed using on device components (e.g.
Windows Defender Antivirus)
Playbook is executed
“suspicious host” playbook is just an example of “catch all” playbook that is applied after detailed AutoIR investigation for evidences raised by alerts / incident to ensure that nothing is missed.
processes list – main image, loaded modules, handles, suspicious memory
created files – x minutes febore / after alert
Security Graph eco system – DaaS, AVaaS, TI, TA, Detection engine, ML
TI indicators – for allow / block list
leveraging OS components (e.g. Defender Antivirus) to perform the remediation
(prebuilt into the system, low level actions (driver), tried and tested)
methods (Reg, Link files, etc.) actions
As we have been reading about many of the advanced threats we see today do try to turn off and tamper with protections that are active on our endpoints.
With Windows Defender you have the option to enable Tamper Protection to make your Windows Defender configuration more safe.
With the protection the client is safeguarded from attempts to disable
Virus and Threat Protection and IOAV
Removal of Security Intelligence Updates
Of course you should not run as local admin as you expose your machine to other risks but this protection helps in some of those scenarios, there are of course other means an attacker can circumvent being detected and that why we strongly recommend adding EDR capabilities to your endpoint security strategy.
To turn this on you simply make sure your machines are managed
You can find the setting under Windows 10 and later > Endpoint Protection and Category > Microsoft Defender Security Center > Tamper Protection
Once you have enabled Tamper Protection assign it to your Endpoints.
On the endpoint you should be able to see that Tamper Protection is turned on in the Windows Security Center
If you are running a early version of Windows 10 you need to have atleast 1709 for this to work and for 1709-1809 you will not see this in the Security Center and need to verify this with powershell and look for the value “isTamperProtected” set to True
Yes you read that right, its now possible to block unsanctioned apps in Microsoft Cloud App Security directly at your Windows 10 Endpoints. Moving towards a Zero-Trust network away from the corporate firewalls and proxies you still want to maintain network control from the endpoint side, this new feature will give you the possibility to block applications, this is a great step forward in the area and its clear that Microsoft is taking Zero-Trust and Security seriously.
(Its important to note if you have marked apps as unsanctioned in the MCAS Portal already they will automatically be marked as blocked so before turning this on review your unsanctioned apps.)
Configuring Unsanctioned Apps
Once you have your requirements in-place we can start to configure unsanctioned apps, You can either select to maintain this manually or configure a policy to set all apps matching a certain criteria to be blocked. An example could be block all apps with a Risk Score Lower than 3.
If you go to your Cloud App Dashboard and find the App you want to block just click on the App and select unsanctioned.
To have apps marked as unsanctioned automatically can be done with a Policy. Below we have an example of blocking apps that meet the criteria Risk Score 1-3.
Its also possible to add other types of criteria if you want to refine your policy. It all depends what you want to limit and the purpose, is it to control Shadow IT or is it from a Security perspective. Some examples below of other criteria that could be useful depending on the use case.
App Category Productivity
Daily Traffic Below 5 MB
Number of Users Below 5
PRO TIP: When building your Policy its very good that you can play with the Preview Results, that gives you instant feedback on how well your query will perform so try that out.
When the unsanctioned app is marked as unsanctioned the back end integration between MCAS and MDATP exchanges data and Custom Indicators are being populated. You can find these under Settings > Indicators > URLs/Domains
Like in this example we did block WhatsApp and that would replicate over to the Indicators in MDATP. The whole flow depending on sync should not take longer than 3 hours. From that you have blocked in MCAS to that the Endpoint has the blocking instruction.
Once its available in MDATP the Endpoints should update their Indicators and should start blocking.
End User Experience
At the moment the end user experience is fairly limited the user would get a Toast Notification that something has been blocked unless you have turned notifications off.
Depending on the App you are trying to communicate with the blocked app/url the behavior would occur differently.
For WhatsApp it would look like this when Launching it (sorry message in Swedish)
And a Default Notification Message like this below
At the moment the tracking and reporting is also limited to whats available in MCAS and MDATP and its supported retention times.
Things I want to see and I have fed back to the Product groups I want this to evolve to going forward.
Support for X-Platform Devices
Block without Alerting like Block and Report
Having the possibility to do Exclusions and Custom Targeting of Devices/Users