The increasing pervasiveness of cloud services in today’s work environments, accelerated by a crisis that forced companies around the globe to shift to remote work, is significantly changing how defenders must monitor and protect organizations. Corporate data is spread across multiple applications—on-premises and in the cloud—and accessed by users from anywhere using any device. With traditional surfaces expanding and network perimeters disappearing, novel attack scenarios and techniques are introduced.
Every day, we see attackers mount an offensive against target organizations through the cloud and various other attack vectors with the goal of finding the path of least resistance, quickly expanding foothold, and gaining control of valuable information and assets. To help organizations fend off these advanced attacks, Microsoft 365 Defender (previously Microsoft Threat Protection) leverages the Microsoft 365 security portfolio to automatically analyze cross-domain threat data, building a complete picture of each attack in a single dashboard. With this breadth and depth of clarity, defenders can focus on critical threats and hunting for sophisticated breaches across endpoints, email, identities and applications.
Among the wide range of actors that Microsoft tracks—from digital crime groups to nation-state activity groups—HOLMIUM is one of the most proficient in using cloud-based attack vectors. Attributed to a Middle East-based group and active since at least 2015, HOLMIUM has been performing espionage and destructive attacks targeting aerospace, defense, chemical, mining, and petrochemical-mining industries. HOLMIUM’s activities and techniques overlap with what other researchers and vendors refer to as APT33, StoneDrill, and Elfin.
HOLMIUM has been observed using various vectors for initial access, including spear-phishing email, sometimes carrying archive attachments that exploit the CVE-2018-20250 vulnerability in WinRAR, and password-spraying. Many of their recent attacks, however, have involved the penetration testing tool Ruler used in tandem with compromised Exchange credentials.
The group used Ruler to configure a specially crafted Outlook Home Page URL to exploit the security bypass vulnerability CVE-2017-11774, which was fixed shortly after it was discovered. Successful exploitation automatically triggered remote code execution of a script when an Outlook client synced with a mailbox and rendered the profile Home Page URL. These scripts, usually VBScript followed by PowerShell, in turn initiated the delivery of various payloads.
In this blog, the first in the Inside Microsoft 365 Defender series, we will show how Microsoft 365 Defender provides unparalleled end-to-end visibility into the activities of nation-state level attacks like HOLMIUM. In succeeding blog posts in this series, we will shine a spotlight on aspects of the coordinated defense delivered by Microsoft 365 Defender.
Tracing an end-to-end cloud-based HOLMIUM attack
HOLMIUM has likely been running cloud-based attacks with Ruler since 2018, but a notable wave of such attacks was observed in the first half of 2019. These attacks combined the outcome of continuous password spray activities against multiple organizations, followed by successful compromise of Office 365 accounts and the use of Ruler in short sequences to gain control of endpoints. This wave of attacks was the subject of a warning from US Cybercom in July 2019.
These HOLMIUM attacks typically started with intensive password spray against exposed Active Directory Federation Services (ADFS) infrastructure; organizations that were not using multi-factor authentication (MFA) for Office 365 accounts had a higher risk of having accounts compromised through password spray. After successfully identifying a few user and password combinations via password spray, HOLMIUM used virtual private network (VPN) services with IP addresses associated with multiple countries to validate that the compromised accounts also had access to Office 365.
Figure 1. Password spray and compromised account sign-ins by HOLMIUM as detected in Microsoft Defender for Identity (previously Azure Advanced Threat Protection) and Microsoft Defender for Cloud Apps (previously Microsoft Cloud App Security)
Armed with a few compromised Office 365 accounts and not blocked by MFA defense, the group launched the next step with Ruler and configured a malicious Home Page URL which, once rendered during a normal email session, resulted in the remote code execution of a PowerShell backdoor through the exploitation of a vulnerability like CVE-2017-11774. The two domains abused by HOLMIUM and observed during this 2019 campaign were “topaudiobook.net” and “customermgmt.net”.
Figure 2. Exploitation of Outlook Home Page feature using Ruler-like tools
Figure 3. Weaponized home page and initial PowerShell payload
This initial foothold allowed HOLMIUM to run their custom PowerShell backdoor (known as POWERTON) directly from an Outlook process and to perform the installation of additional payloads on the endpoint with different persistence mechanisms, such as WMI subscription (T1084) or registry autorun keys (T1060). Once the group has taken control of the endpoint (in addition to the cloud identity), the next phase was hours of exploration of the victim’s network, enumerating user accounts and machines for additional compromise, and lateral movement within the perimeter. HOLMIUM attacks typically took less than a week from initial access via the cloud to obtaining unhampered access and full domain compromise, which then allowed the attackers to stay persistent for long periods of time, sometimes for months on end.
Figure 4. Snippets of HOLMIUM PowerShell backdoor (POWERTON) implementing two different persistence mechanisms: WMI event subscription (T1084) and Registry run keys or Startup folder (T1060)
HOLMIUM attacks as seen and acted upon by Microsoft 365 Defender
HOLMIUM attacks demonstrate how hybrid attacks that span from cloud to endpoints require a wide range of sensors for comprehensive visibility. Enabling organizations to detect attacks like these by correlating events in multiple domains – cloud, identity, endpoints – is the reason why we build products like Microsoft 365 Defender. As we described in our analysis of HOLMIUM attacks, the group compromised identities in the cloud and leveraged cloud APIs to gain code execution or persist. The attackers then used a cloud email configuration to run specially crafted PowerShell on endpoints every time the Outlook process is opened.
During these attacks, many target organizations reacted too late in the attack chain—when the malicious activities started manifesting on endpoints via the PowerShell commands and subsequent lateral movement behavior. The earlier attack stages like cloud events and password spray activities were oftentimes missed or sometimes not linked with activities observed on the endpoint. This resulted in gaps in visibility and, subsequently, incomplete remediation.
While it’s relatively easy to remediate and stop malicious processes and downloaded malware on endpoints using endpoint security solutions, such a conventional approach would mean that the attack is persistent in the cloud, so the endpoint could be immediately compromised again. Remediating identities in the cloud is a different story.
Figure 5. The typical timeline of a HOLMIUM attack kill-chain
In an organization utilizing Microsoft 365 Defender, multiple expert systems that monitor various aspects of the network would detect and raise alerts on HOLMIUM’s activities. Microsoft 365 Defender sees the full attack chain across domains beyond simply blocking on endpoints or zapping emails, thus putting organizations in a superior position to fight the threat.
Figure 6. Microsoft 365 Defender components able to prevent or detect HOLMIUM techniques across the kill chain.
These systems work in unison to prevent attacks or detect, block, and remediate malicious activities. Across affected domains, Microsoft 365 Defender detects signs of HOLMIUM’s attacks:
- Microsoft Defender for Identity (previously Azure Advanced Threat Protection) identifies account enumeration and brute force attacks
- Microsoft Defender for Cloud Apps (previously Microsoft Cloud App Security) detects anomalous Office 365 sign-ins that use potentially compromised credentials or from suspicious locations or networks
- Microsoft Defender for Endpoint (previously Microsoft Defender Advanced Threat Protection) exposes malicious PowerShell executions on endpoints triggered from Outlook Home Page exploitation
Figure 7. Activities detected across affected domains by different Microsoft 365 Defender expert systems
Traditionally, these detections would each be surfaced in its own portal, alerting on pieces of the attack but requiring the security team to stitch together the full picture. With Microsoft 365 Defender, the pieces of the puzzle are fused automatically through deep threat investigation. Microsoft 365 Defender generates a combined incident view that shows the end-to-end attack, with all related evidence and affected assets in one view.
Figure 8. The Microsoft 365 Defender incident brings together in one view the entire end-to-end attack across domain boundaries
Understanding the full attack chain enables Microsoft 365 Defender to automatically intervene to block the attack and remediate assets holistically across domains. In HOLMIUM attacks, Microsoft 365 Defender not only stops the PowerShell activity on endpoints but also contains the impact of stolen user accounts by marking them as compromised in Azure AD. This invokes Conditional Access as configured in Azure AD and applies conditions like MFA or limitations on the user account’s permissions to access organizational resources until the account is remediated fully.
Figure 9. Coordinated automatic containment and remediation across email, identity, and endpoints
Security teams can dig deep and expand their investigation into the incident in Microsoft 365 Security Center, where all details and related activities are available in one place. Furthermore, security teams can hunt for more malicious activities and artifacts through advanced hunting, which brings together all the raw data collected across product domains into one unified schema with powerful query constructs.
Figure 10. Hunting for activities across email, identity, endpoint and cloud applications
Finally, when the attack is blocked and all affected assets are remediated, Microsoft 365 Defender helps organizations identify improvements to their security configuration that would prevent the attacker from returning. The Threat Analytics report provides an exposure view and recommends prevention measures relevant to the threat. For example, the Analytics Report for HOLMIUM recommended, among other things, applying the appropriate security updates to prevent tools like Ruler from operating, as well as completely eliminating this attack vector in the organization.
Figure 11. Threat Analytics provides organizational exposure and recommended mitigations for HOLMIUM
Microsoft 365 Defender: Stop attacks with automated cross-domain security
Microsoft 365 Defender harnesses the power of Microsoft 365 security products to deliver unparalleled coordinated defense that detects, correlates, blocks, remediates, and prevents attacks across an organization’s Microsoft 365 environment. Existing Microsoft 365 licenses provide access to Microsoft 365 Defender features in Microsoft 365 security center without additional cost. To start using Microsoft 365 Defender, go to security.microsoft.com.
Learn how Microsoft 365 Defender can help your organization to stop attacks with coordinated defense. Read these blog posts in the Inside Microsoft 365 Defender series:
- Inside Microsoft 365 Defender: Attack modeling for finding and stopping lateral movement
- Inside Microsoft 365 Defender: Correlating and consolidating attacks into incidents
- Inside Microsoft 365 Defender: Solving cross-domain security incidents through the power of correlation analytics
Talk to us
Questions, concerns, or insights on this story? Join discussions at the Microsoft 365 Defender tech community.
Follow us on Twitter @MsftSecIntel.