Targeted Attacks Leveraging Domain Credentials

Number: AL14-031
Date: 29 July 2014

Purpose

The purpose of this Alert is to bring attention to targeted attacks using compromised domain credentials.

Assessment

CCIRC has received a report of advanced persistent threat (APT) activity in ongoing targeted attacks using compromised domain credentials.

Suggested action

• CCIRC recommends that organizations review Microsoft Security Advisory 2963983 and consider implementing the suggested workarounds to help mitigate the risks.
• Consider installing Microsoft's Experience Mitigation Toolkit 4.1 (EMET). The Enhanced Mitigation Experience Toolkit (EMET) helps mitigate the exploitation of vulnerabilities by adding additional protection layers that make them harder to exploit. NOTE: EMET 3.0 does not mitigate this issue.
• Review CCIRCs Mitigation Guidelines for Advanced Persistent Threats (TR11-002) that helps define APT, describes typical APT attack methodologies and to introduces mitigation and monitoring techniques that may reduce the risk to organizations.
• Implement the first 4 of the Top 35 mitigations, as noted in CCIRC's TR11-002 Mitigation Guidelines for Advanced Persistent Threats.

References:

1. CCIRC's TR11-001 Malware Infection Recovery Guide
   http://www.publicsafety.gc.ca/cnt/rsrcs/cybr-ctr/2011/tr11-001-eng.aspx
   
   
2. CCIRC's TR11-002 Mitigation Guidelines for Advanced Persistent Threats
   http://www.publicsafety.gc.ca/cnt/rsrcs/cybr-ctr/2011/tr11-002-eng.aspx
   
   
3. Top 4 Strategies to Mitigate Targeted Cyber Intrusions
   http://www.publicsafety.gc.ca/cnt/ntnl-scrt/cbr-scrt/tp-strtgs-eng.aspx
   
   
4. CSEC Top 35 Mitigation Measures - Guidance for the Government of Canada
   https://www.cse-cst.gc.ca/en/publication/itsb-89a
   
   
5. FireEye Blog, New Zero-Day Exploit targeting Internet Explorer Versions 9 through 11 Identified in Targeted Attacks
   http://www.fireeye.com/blog/uncategorized/2014/04/new-zero-day-exploit-targeting-internet-explorer-versions-9-through-11-identified-in-targeted-attacks.html
   
   
6. FireEye Blog, Clandestine Fox, Part Deux
   http://www.fireeye.com/blog/technical/targeted-attack/2014/06/clandestine-fox-part-deux.html
   
   
7. CCIRC Advisory AV14-024 - Microsoft Security Bulletin Release (Out of Band) – Security Update for Internet Explorer (2965111)
   http://www.publicsafety.gc.ca/cnt/rsrcs/cybr-ctr/2014/av14-024-eng.aspx
   
   
8. CCIRC Alert AL14-029 - Vulnerability in Internet Explorer Could Allow Remote Code Execution
   http://www.publicsafety.gc.ca/cnt/rsrcs/cybr-ctr/2014/al14-029-eng.aspx
   
   
9. Microsoft - Security Advisory 2953095: recommendation to stay protected and for detections
   http://blogs.technet.com/b/srd/archive/2014/03/24/security-advisory-2953095-recommendation-to-stay-protected-and-for-detections.aspx
   
   
10. Microsoft Security Bulletin MS14-021 - Critical
    https://technet.microsoft.com/library/security/ms14-021

Date modified:

2015-12-02