Cервис управления информационной безопасностью
Cервис управления информационной безопасностью
Вход Регистрация
MITRE ATT&CK - Technique Conditional Access Policies
CVE уязвимости
БДУ ФСТЭК уязвимости
НКЦКИ уязвимости
MITRE ATT&CK
БДУ ФСТЭК
Новая БДУ ФСТЭК
RU
Риски
Каталоги
MITRE ATT&CK
Техника
Conditional Access Policies
Куда я попал?
SECURITM это SGRC система, ? автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.
Подробнее
Наш канал

Modify Authentication Process:  Conditional Access Policies

ID Name
.001 Domain Controller Authentication
.002 Password Filter DLL
.003 Pluggable Authentication Modules
.004 Network Device Authentication
.005 Reversible Encryption
.006 Multi-Factor Authentication
.007 Hybrid Identity
.008 Network Provider DLL
.009 Conditional Access Policies

Adversaries may disable or modify conditional access policies to enable persistent access to compromised accounts. Conditional access policies are additional verifications used by identity providers and identity and access management systems to determine whether a user should be granted access to a resource. For example, in Entra ID, Okta, and JumpCloud, users can be denied access to applications based on their IP address, device enrollment status, and use of multi-factor authentication.(Citation: Microsoft Conditional Access)(Citation: JumpCloud Conditional Access Policies)(Citation: Okta Conditional Access Policies) In some cases, identity providers may also support the use of risk-based metrics to deny sign-ins based on a variety of indicators. In AWS and GCP, IAM policies can contain `condition` attributes that verify arbitrary constraints such as the source IP, the date the request was made, and the nature of the resources or regions being requested.(Citation: AWS IAM Conditions)(Citation: GCP IAM Conditions) These measures help to prevent compromised credentials from resulting in unauthorized access to data or resources, as well as limit user permissions to only those required. By modifying conditional access policies, such as adding additional trusted IP ranges, removing Multi-Factor Authentication requirements, or allowing additional Unused/Unsupported Cloud Regions, adversaries may be able to ensure persistent access to accounts and circumvent defensive measures.

ID: T1556.009
Sub-technique of:  T1556
Tactic(s): Credential Access, Defense Evasion, Persistence
Platforms: IaaS, Identity Provider
Data Sources: Active Directory: Active Directory Object Modification, Cloud Service: Cloud Service Modification
Created: 02 Jan 2024
Last Modified: 16 Sep 2024

Procedure Examples
Name Description
Scattered Spider

Scattered Spider has added additional trusted locations to Azure AD conditional access policies. (Citation: MSTIC Octo Tempest Operations October 2023)

Mitigations
Mitigation Description
User Account Management

Manage the creation, modification, use, and permissions associated to user accounts.

References

  1. Okta. (2023, November 30). Conditional Access Based on Device Security Posture. Retrieved January 2, 2024.
  2. Microsoft. (2023, November 15). What is Conditional Access?. Retrieved January 2, 2024.
  3. JumpCloud. (n.d.). Get Started: Conditional Access Policies. Retrieved January 2, 2024.
  4. Google Cloud. (n.d.). Overview of IAM Conditions. Retrieved January 2, 2024.
  5. AWS. (n.d.). IAM JSON policy elements: Condition. Retrieved January 2, 2024.
  6. Microsoft. (2023, October 25). Octo Tempest crosses boundaries to facilitate extortion, encryption, and destruction. Retrieved March 18, 2024.
  7. Microsoft. (2023, October 23). Troubleshooting Conditional Access policy changes. Retrieved January 2, 2024.
Навигация

Связанные риски

Ничего не найдено

Каталоги

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.