Lessons Learned from the Jan 12th Microsoft Security Breach
What Happened
On January 12th, 2024, Microsoft detected that their corporate systems were hacked by a nation-state. The threat actor successfully exfiltrated emails and attached documents belonging to some members of the Microsoft senior leadership team, as well as employees in the cybersecurity, legal, and other functions.
Microsoft found that beginning in late November 2023, the threat actor used a password spray attack to compromise a legacy non-production test tenant account. The actor then leveraged this access to gain a foothold in the Microsoft production systems.
Lessons Learned
1. Consider Adopting Continuous Monitoring (ConMon)
Continuous monitoring (ConMon) increases the likelihood of identifying unauthorized activity in your information systems. Without ConMon, Microsoft may not have detected this cyber-attack. Man-made information systems can be hacked irrespective of investments in defensive mechanisms.
Thankfully, it took less than two months for Microsoft to discover that their corporate systems had been hacked (late November 2023 to Jan 12th, 2024). Imagine what would have happened if this cyber breach had gone undetected for six months or—even worse—a year. To mitigate such risks, incorporating continuous monitoring into your cybersecurity program is crucial.
2. Review the Registered Applications, Service Principals, and the Corresponding Permissions in Your Entra ID Tenant
Registered applications with specific Microsoft Graph permissions can access your Microsoft 365 tenant as a global admin without requiring multi-factor authentication. As a result, it is crucial to regularly review the registered applications, service principals, and the corresponding Microsoft Graph permissions granted to these applications in your Microsoft 365 tenant. This helps verify authorization, necessity, and any associated risks.
3. Implement Multi-Factor Authentication (MFA)
One of the initial attack vectors in this breach was password spraying (password guessing). The Microsoft breach article doesn't explicitly mention if MFA was required for the compromised legacy non-production test tenant account. However, even if the threat actor guessed or cracked the password, the presence of MFA may have increased the difficulty, prolonged the hacking time, or prevented a successful exploit. Consider implementing MFA for your accounts.
Link to the Microsoft breach article - Microsoft Actions Following Attack by Nation State Actor Midnight Blizzard | MSRC Blog | Microsoft Security Response Center