EPMFundamentalsCredentialTheftProtection

andEventMonitoringThissessionwillexplainthefollowingconceptsandfunctionality:ThreatDetection

PrivilegeThreatAnalytics(PTA)andSIEMIntegration

ReportsandDashboardsObjectivesWhatriskdocompromisedcredentialsrepresent?GivedirectaccesstoaccountsonvariousplatformsUserspecifiessamepasswordforseveralaccountsondifferentplatformsThreatDetectionmonitorsfordifferentattackvectorsNoadditionalendpointrequirementotherthanEPMagentFunctionalityintendedtobecontinuouslyupdatedDetectandBlockSuspectedCredentialTheftAttemptsbyMaliciousUsersandApplicationsHowtheTechnologyisDesignedCyberArkLabinvestigates

variousattackvectorsAlertissenttoEPMconsoleAttackindicationareextracted(e.g.unexpectedaccesstoLSASSmemory)EPMinternalpolicyisupdated

byR&DwiththeindicatorsEPMdevicedrivernowhookstheseaccessestoLSASSAccessisblockedBLOCKINGMODEAccessisdetectedDETECTIONMODEDetectaPotentialSecurityThreat(1)RulesNameDescriptionProtectsLSASSCredentialsHarvestingLocalSecurityAuthoritySubsystemService(LSASS)isresponsibleforenforcingthesecuritypolicyonthesystem.ItverifiesusersloggingontoaWindowscomputerorserver,handlespasswordchanges,andcreatesaccesstokens.Itretainsuserscredentialsinmemory,bothashashesandcleartext,andisamainattackpoint.AllworkstationsandServersSAMHashHarvestingTheSecurityAccountManager(SAM)storesusers'passwords.Itcanbeusedtoauthenticatelocalandremoteusers.CredentialsaresavedinSAMasNTLMhashes,whichcanbeeasilyuncoveredwithnewcomputers.AllworkstationsandServersDetectaPotentialSecurityThreat(2)RulesNameDescriptionProtectsDomainCredentialTheftFromLocalCacheTheDomainCredentialsCache(msvcachedv2)containshashesofdomainusers'credentials.Itisusedtovalidatedomainuserswhologinfromoutsidetheirorganization'snetwork.AllworkstationsandServersCredentialTheftFromServiceAccountServicescanbeexecutedwithdifferentpermissions,usingdifferentusers.Toenabletheservicetostartevenwhentheuserisnotloggedin,thecredentialsarestoredonthemachine.Anattackercanusethesecredentialstorunmaliciouscodewiththeserviceuser’spermissions.SomeMicrosoftservicescontaindomainusercredentials.AttackerscanharvestencryptedservicecredentialsfromtheLocalSecurityAuthority(LSA)Secretsregistryhiveandinjectthemintoanewmaliciousservicetoachievelateralmovementandfulldomaincompromise.AllworkstationsandServersDetectaPotentialSecurityThreat(3)RulesNameDescriptionProtectsAgentSafeProtectionWindowsSafeModeisbuiltintoallWindowsOperatingSystems(OS)onbothPCsandservers.InWindows10,SafeModeturnsoffMicrosoft’sVirtualSecureModule(VSM).AttackerscanremotelyactivateSafeModetobypassandmanipulateendpointsecuritymeasures,achievelateralmovementandstealcredentials.AllworkstationsandServersCredentialTheftFromWindowsCredentialManagerWindowscredentialmanagerallowsuserstosavetheirlogininformationforwebsites(IEandEdgebrowsers),connectedapplications,andnetworks.Attackerscaneasilyfetchtheusers’credentialsbyusingundocumentedwindowsAPIs.AllworkstationsandServersDetectaPotentialSecurityThreat(4)RulesNameDescriptionProtectsCredentialTheftFromActiveDirectoryDatabase(NTDS.DIT)TheMicrosoftActiveDirectoryDataStore(NTDS.dit)containsdatabasefilesandprocessesthatstoreandmanagedirectoryinformationforusers,services,andapplications.Anattackercanstealthekrbtgtaccount,whichisapreliminarysteptotheGoldenTicketattack,andharvestalltheorganizationuserhashestoexecutepassthehashattacksandlateralmovesintheorganizationnetwork.Servers(DC)LocalSecurityAuthority(LSA)SecretsHarvestingLSASecretsisaspecialprotectedstorageforimportantdatausedbytheLocalSecurityAuthority(LSA)onWindows.Thesecretscancontainuserpasswords,serviceaccountpasswords,RASconnectionpasswords,userencryptionkeysandmore,allofwhicharevaluableforattackers.AllworkstationsandServersDetectaPotentialSecurityThreat(5)RulesNameDescriptionProtectsPassTheHashAttackPasswordhashesareequivalenttoclear-textpasswords.Anattackerwhoobtainsapasswordhashcanuseittogainaccesstoasystemwithouttheneedtoknowtheactualpassword.ThistypeofattackisknownasPassTheHash.AllworkstationsandServersCryptoRSAMachineKeysHarvestingRSAisanasymmetricencryptionalgorithm.Theprivatekeycanbeusedforauthentication,encryption,andsigning,andforasymmetrickeyexchangeduringestablishmentofanSSL\TLSsession.Stolenprivatekeyscanbeusedforavarietyofpostexploitationattacks,suchasstealingauthenticationtokensfromanyidentitymanagementsolutionthatstoresitskeyintheWindowsprivatekeystore.Serversonly(identitymanagementsolutionslikeADFSandOkta)DetectaPotentialSecurityThreat(6)RulesNameDescriptionProtectsKerberosTicketHashHarvestingKerberosticketsaretheauthenticationobjectsusedinadomainenvironment.PasstheticketisamethodofauthenticationtoasystemusingaKerberosticketwithouthavingaccesstotheaccount'spassword.Inthisattack,avalidKerberosticketisobtainedandinjectedinthememoryoftheattacker'ssession.AllworkstationsandServersTotalCommanderCredentialsTheft(*Beta)TotalCommanderisapopularfilemanagerforWindowsthatcanalsomanageFTPconnections.UserscanstoretheirFTPServerpasswordslocallyusingTotalCommander,exposingtheircredentialstopotentialattackersrunningonthemachine.AllworkstationsandServersDetectaPotentialSecurityThreat(7)RulesNameDescriptionProtectsPuTTyCredentialsTheft(*Beta)PuTTyisapopularSSHclientforWindows.TheapplicationstoresprivateSSHkeysthatcanbeusedascredentialstoremoteServers.Inaddition,PuTTyenablesyoutostorepasswordsforproxyServerslocally.StoringtheprivateSSHkeysorproxypasswordleavesusercredentialsexposedtoattackers.AllworkstationsandServersOktaADAgentTamperProtection(*Beta)OKTAhasanADAgentthatmanagesconnectionfromanActiveDirectoryenvironment.Theagentstoresatokentothedomainthatcanbeabusedbyanattackertostealusercredentialsfromthedomain.EPMprotectsthistokenandtheagent’sprivatekey(usingtheCryptoRSAMachineKeysHarvestingrule)frombeingstolen,theADagentfrombeingmanipulatedandtheauthenticationprocessfrombeingtamperedwith.OKTAADAgentserversThreatDetectionUIClickingonThreatDetection

showsallpoliciesShowswhetherstatusisactiveornotforeachpolicyAlsoshowsifpolicyissettodetectorblockattackActivatingTheftDetectionPoliciesClickonOptionsthenActivateallToactivatesinglepolicies,selectdesiredpolicythen:RightclickonpolicyandclickActivateindrop-downClickonOptionsthenActivateEditingaThreatDetectionPolicyActivatingapolicysetsactiontoDetectbydefaultToblockandchangeadvancedpolicysettings,right-clickonpolicyandclickEditEditingaThreatDetectionPolicy(Action)ActivatingapolicysetsactiontoDetectbydefaultDetect:

Credentialtheftattemptsarenotblocked,butgeneratealertsBlock:

BlockfutureattemptsofcredentialtheftEditingaThreatDetectionPolicy(ApplyPolicytoselectedComputersinSet,ADComputerGroups)ThreatDetectionPoliciescanberestrictedto:SpecificComputersEPMComputerGroupsADComputerGroups

EditingaThreatDetectionPolicy(ExcludedApps)Ifnecessary,excludespecificapplicationsfromPolicyClickonNewtoaddexclusionsExclusioncanbeappliedtofilename,pathWildcardscanbeusedforfilenameorpathEditingaThreatDetectionPolicy(End-UserUI)SetwhetheruserwillbealertedwhenpolicyistriggeredDefaultisShowNothingOtherwise,selectwhichmessagewillbedisplayedtoend-userviasystemtraybubble.DefinitionsarestoredinPASPD.DLL

CyberArkwillreleasenewversionsoftheDLLwithenhancedprotectionagainstnewattackvectors

UpgradedfilescanbeuploadedbyaccountadministratorsThreatDetectionDefinitionsFileUpdatingThreatDetectionDefinitionsFileLoginasanaccountadministratorBrowsetoConfiguration=>ThreatDetectionClickonUpgradeBrowsetoandselectupdatedfile,thenclickonOKStep1–Activateforapilotgroup(e.g.activatethepolicyonlyontheITgroupthatisconsideredasEPMchampions)Step2–Defineexclusionasneededbasedonpilotgroup(e.g.exclusionforbackupsoftware)Step3–Expandpolicyapplicationfortheentiregroup/organization.Step4–MonitorandadjustaccordingtoneedsPolicyactivationmendationsPrivilegeThreatAnalytics(PTA)

andSIEMIntegration*PTAintegrationnotavailableforSaaSinstallationsNOTE:PTAIntegrationtoShowCredentialsTheftIncidents*ThreatDetectioneventsinEPMcantriggeralertsinPTA(PrivilegedThreatAnalytics)AlertsaredisplayedinthePTAconsoleSOC(SecurityOpsCentre)staffcandrilldownintoeventtoseemoreinformationRetrievingConnectionCredentialsfromPTATheconnectionbetweenEPMandPTAneedstobeauthenticatedRequiredcredentialsarestoredinfilecalledprepwiz.logonPTAserverForPTA3.3,fileislocatedin/opt/apache-tomcat-7.0.40/prepwiz/logsSearchforEPPcredentials,noteUsernameandPasswordConfiguringPTAintegrationIntheConfiguration=>ThreatDetectionsection,clickonPTAConfiguration

EntertheUsernameandPasswordretrievedfromprepwiz.log

ClickonSaveConfiguringEventListenersAllowsconfigurationofexternallistenerssuchasSIEM

InServerConfiguration=>EventListenerssection,clickonNonenexttoThird-PartyListenersConfiguringEventListenersOntheChangeConfigurationParameterValuescreen,clickonOffnexttothelistener

SelectOnfromthedropdownSettheconfigurationasrequiredClickOKthenSaveSupportedEventListenersLogstash-Systemforlogcollection,processing,storageandsearchingactivities.TextFile–XMLfilecreatedontheEPMServerSysLog-Astandardformessageloggingthatpermitsseparationofthesoftwarethatgeneratesmessages,thesystemthatstoresthem,andthesoftwarethatreportsandanalyzesthem.Splunk-Captures,indexesandcorrelatesreal-timedatainasearchablerepositoryfromwhichyoucangenerategraphs,reports,alerts,dashboardsandvisualizations.MoreinformationiscontainedintheCyberArkEndpointPrivilegeManagerSolutionGuideReportsReportsReportscanbegeneratedundertheReportstabinthemainSetUIReportsaresplitintofunctionalcategoriesReportsReportsareavailabl