The Adversary’s Path to Achieving Persistence
Once SCATTERED SPIDER gains access to a target organization, they work to ensure persistence in the environment. In one example, the adversary added unauthorized federated identity providers to Azure AD/Entra ID tenants, creating persistent backdoor access that bypasses standard security controls. This technique involves establishing trust relationships with attacker-controlled identity providers, allowing them to authenticate as legitimate users. Their federation manipulation remains effective even after password resets, making this a particularly dangerous persistence mechanism. This approach enables SCATTERED SPIDER to maintain access long after initial detection and remediation efforts.
Falcon Next-Gen SIEM provides numerous rule templates that may be leveraged to identify this attack vector, as well as similar attacks, as outlined within the list below:
- Microsoft - Entra ID - External Organization Connected to Directory
- Microsoft - Entra ID - Cross Tenant Partner Given Inbound Access
- Microsoft - Entra ID - Modification of Federated Identity Credentials for Service Principals or Applications
- Microsoft - M365 Exchange Online - Persistence via Identity Provider
- Okta - SSO - IDP Provider Modification
- Okta - SSO - Sign-In Events via Third-Party IdP
- Fortinet - NGFW - Identity Provider Added
- Fortinet - NGFW - Identity Provider Removed
Let’s now examine another rule in depth to see how CQL supports detection of potential malicious behavior involving persistence. The following query stems from the “Microsoft - Entra ID - Modification of Federated Identity Credentials for Service Principals or Applications” rule. This rule monitors modifications to federated identity credentials in Microsoft Entra ID, a technique frequently exploited by adversaries for persistence and privilege escalation.
// Rule Name: Microsoft - Entra ID - Modification of Federated Identity Credentials for Service Principals or Applications
// Description: This rule detects the addition of a federated identity credential to a service principal or application registration, a tactic that adversaries may use to persist in an environment by creating and/or modifying service principals. For instance, adding a federated identity credential to a user-assigned managed identity service principal could potentially allow an adversary to authenticate and obtain an access token for the tenant from outside an Azure-owned resource. However, this attack would require the adversary to already possess high privileges within the tenant, granting them the ability to add credentials to applications.
// Severity: Low
// MITRE ATT&CK: T1556.007 - Modify Authentication Process: Hybrid Identity
//
// Detection Logic:
// - Identify targeted Microsoft products
// - Seek out instances where updates to the application or service principal are observed
// - Identify instances where modification events are present
#Vendor="microsoft" #event.dataset=/entraid\.audit/ #repo!="xdr*"
| event.action="update-application" OR event.action="update-service-principal"
| case {
#event.module="azure" // Data Connector built for Microsoft Graph API; Parser: azuread-ecs
| split(Vendor.targetResources)
| split(Vendor.targetResources.modifiedProperties)
| Vendor.targetResources.modifiedProperties.displayName="FederatedIdentityCredentials";
#event.module="entraid" // Data Connector built for Microsoft Entra ID; Parser: entraid-ecs;
| split(Vendor.properties.targetResources)
| split(Vendor.properties.targetResources.modifiedProperties)
| Vendor.properties.targetResources.modifiedProperties.displayName="FederatedIdentityCredentials";
}
As shown in the query above, we initially focus on Microsoft log sources, as the targeted products (Azure and Entra ID) are tied to this vendor. Subsequently, we further filter down on actions related to updates within either the application or service principal. Finally, we build out a case statement that allows us to target both Azure and Entra ID, looking for properties within the logs that will denote the expected modification behavior.
Privilege Escalation in Cloud Environments
Adversaries such as SCATTERED SPIDER consistently target Global Administrator privileges in Azure/Entra ID environments, demonstrating their sophisticated understanding of cloud security architecture. By escalating to Global Administrator status, these adversaries gain the ultimate access level within Microsoft's identity management framework, enabling them to bypass security controls across the entire tenant. This privileged position allows them to modify authentication requirements, disable security features like MFA, and create persistent backdoor accounts while evading detection. Their methodical privilege escalation strategy reveals a calculated approach focused on achieving complete tenant control, highlighting why defending these elevated permissions is a critical security priority for organizations operating in Azure environments.
The following rule templates may be leveraged to identify this attack vector, as well as similar attacks:
- Microsoft - Entra ID - Global Administrator Role Assigned
- Microsoft - Entra ID - Privileged Role Assigned to User Account outside of PIM
- Microsoft - Entra ID - Privileged Role Assigned to User Account in PIM as Active Assignment
- Microsoft - Entra ID - Privileged Role Assigned to User Account in PIM as Eligible Assignment
Adversary Impact and Data Exfiltration
SCATTERED SPIDER operators deploy ransomware as a primary attack vector. While CrowdStrike Falcon® Insight XDR endpoint protection secures endpoints against these threats, unmonitored VMware infrastructure creates significant visibility gaps that attackers routinely exploit.
Falcon Next-Gen SIEM extends detection capabilities into VMware environments, identifying malicious activities before full compromise occurs. Technical implementation details are available in the VMware integration documentation in Falcon Next-Gen SIEM.
SCATTERED SPIDER often pairs ransomware with data exfiltration techniques. Falcon Next-Gen SIEM implements several detection rules targeting these exfiltration methods:
- CrowdStrike - Endpoint - Exfiltration to File Sharing Services during Interactive RDP Session
- CrowdStrike - Endpoint - DNS Request For Online File Sharing Site From Unusual Image File Name
- Generic - Web - HTTP Request to Paste Site
- Microsoft - M365 OneDrive & SharePoint - Excessive Data Download Activity
Figure 3 shows the “Microsoft - M365 OneDrive & SharePoint - Excessive Data Download Activity” rule firing within Falcon Next-Gen SIEM.
![Helping Non-Security Stakeholders Understand ATT&CK in 10 Minutes or Less [VIDEO]](https://assets.crowdstrike.com/is/image/crowdstrikeinc/video-ATTCK2-1?wid=530&hei=349&fmt=png-alpha&qlt=95,0&resMode=sharp2&op_usm=3.0,0.3,2,0)
![Qatar’s Commercial Bank Chooses CrowdStrike Falcon®: A Partnership Based on Trust [VIDEO]](https://assets.crowdstrike.com/is/image/crowdstrikeinc/Edward-Gonam-Qatar-Blog2-1?wid=530&hei=349&fmt=png-alpha&qlt=95,0&resMode=sharp2&op_usm=3.0,0.3,2,0)
