CISA Cyber Security News – Threat Activity in Microsoft Cloud

January 14, 2021

cyber-security-lock-key

 

CISA has reported seeing post-compromise threat activity in Microsoft Cloud/Azure environments, identifying three key components of this advanced persistent threat:

  • Compromise / bypassing of federated identity solutions
  • Use of forged authentication tokens to move laterally to Microsoft cloud environments
  • Use of privileged access to a victim’s cloud environment to establish difficult-to-detect persistence mechanisms for Application Programming Interface (API)-based access.

In response, CISA is providing cyber security guidance on use of open-source tools, including a tool developed by CISA named Sparrow. This information technology tool helps in the analysis of Microsoft 365/Azure environments to detect potentially malicious activity.

For more information on this advanced persistent threat and open-source tools please visit CISA.gov, or reach out to our QED National team directly.

Posted in QED National News and tagged , ,