Adversaries may disable or modify conditional access policies to enable persistent access to compromised accounts. Conditional access policies are additional verifications used by identity providers and identity and access management systems to determine whether a user should be granted access to a resource.
For example, in Azure AD, Okta, and JumpCloud, users can be denied access to applications based on their IP address, device enrollment status, and use of multi-factor authentication.[1][2][3] In some cases, identity providers may also support the use of risk-based metrics to deny sign-ins based on a variety of indicators. In AWS and GCP, IAM policies can contain condition
attributes that verify arbitrary constraints such as the source IP, the date the request was made, and the nature of the resources or regions being requested.[4][5] These measures help to prevent compromised credentials from resulting in unauthorized access to data or resources, as well as limit user permissions to only those required.
By modifying conditional access policies, such as adding additional trusted IP ranges, removing Multi-Factor Authentication requirements, or allowing additional Unused/Unsupported Cloud Regions, adversaries may be able to ensure persistent access to accounts and circumvent defensive measures.
ID | Name | Description |
---|---|---|
G1015 | Scattered Spider |
Scattered Spider has added additional trusted locations to Azure AD conditional access policies. [6] |
ID | Mitigation | Description |
---|---|---|
M1018 | User Account Management |
Limit permissions to modify conditional access policies to only those required. |
ID | Data Source | Data Component | Detects |
---|---|---|---|
DS0026 | Active Directory | Active Directory Object Modification |
Monitor for changes made to security settings related to Azure AD Conditional Access Policies. For example, these can be found in the Azure AD audit log under the operation name |
DS0025 | Cloud Service | Cloud Service Modification |
Monitor for changes made to conditional access policies used by SaaS identity providers and internal IaaS identity and access management systems. |