Network Trust Dependencies
Network Trust Dependencies [T1590.003]
Last updated
Network Trust Dependencies [T1590.003]
Last updated
Name: Network Trust Dependencies
ID: T1590.003
Tactics:
Technique:
Network Trust Dependencies (T1590.003) is a sub-technique within the MITRE ATT&CK framework under the broader technique of Gather Victim Network Information (T1590). It involves adversaries exploiting the inherent trust relationships established between networked systems and services. Attackers utilize these dependencies to move laterally, escalate privileges, or maintain persistent access within a compromised environment. By exploiting trust relationships, adversaries can circumvent certain security controls, propagate malware, or exfiltrate sensitive data, significantly increasing the potential damage of an intrusion.
Network Trust Dependencies exploitation involves adversaries identifying and leveraging implicit or explicit trust relationships between devices, users, or services within a network. These dependencies often exist due to administrative convenience, legacy system configurations, or insufficient network segmentation. Attackers typically leverage trust relationships in the following ways:
Domain Trust Exploitation:
Attackers may exploit existing trust relationships between Active Directory domains or forests to escalate privileges or move laterally.
Techniques include abusing trust relationships to authenticate as domain administrators or leveraging cross-domain authentication mechanisms.
Service-Level Trust Relationships:
Exploiting trust relationships between internal services, such as database servers trusting application servers, or web servers trusting backend services.
Attackers can leverage compromised hosts or services to access sensitive information or pivot to additional internal systems.
Implicit Network Trust:
Attackers exploit implicit trust within network segments, such as internal networks trusting connections from specific IP addresses or network segments.
This includes leveraging the lack of network segmentation to propagate malware or perform reconnaissance.
Misconfigured Authentication and Authorization:
Exploiting misconfigured authentication mechanisms, such as overly permissive firewall rules or insufficiently secured service accounts.
Attackers may use compromised credentials or tokens to authenticate to trusted systems without raising alarms.
Real-world procedures commonly involve attackers performing reconnaissance to identify trust relationships using tools such as BloodHound, PowerSploit, or custom scripts. Once identified, attackers exploit these relationships to move laterally, escalate privileges, or maintain persistence.
Adversaries typically exploit network trust dependencies during multiple stages of an attack lifecycle, including:
Initial Access and Reconnaissance:
Attackers may initially exploit trust relationships to gain initial footholds or identify additional targets within a network.
Privilege Escalation:
Leveraging domain trusts or service-level dependencies to escalate privileges from compromised accounts or hosts to higher-privileged entities.
Lateral Movement:
Exploiting trust relationships to move laterally across network segments, domains, or trusted third-party systems.
Persistence and Defense Evasion:
Utilizing trusted relationships to maintain persistent access or evade detection by blending in with legitimate network traffic and authenticated sessions.
Data Exfiltration:
Exploiting trusted pathways or connections to exfiltrate sensitive data without triggering network security controls or alarms.
Detection of Network Trust Dependencies exploitation involves monitoring and analyzing various network and authentication activities. Common detection methods and tools include:
Network Monitoring and Traffic Analysis:
Monitoring unusual connections or data flows between trusted network segments or domains.
Tools: Zeek (Bro), Wireshark, NetFlow analyzers, network IDS/IPS.
Authentication Log Analysis:
Analyzing authentication logs for unusual or unexpected cross-domain authentication events, failed authentication attempts, or abnormal use of domain trust relationships.
Tools: Splunk, ELK Stack, Microsoft Defender for Identity (formerly Azure ATP).
Endpoint Detection and Response (EDR):
Monitoring endpoint activities for suspicious lateral movement, credential access, or abnormal service interactions.
Tools: CrowdStrike Falcon, Carbon Black, Microsoft Defender for Endpoint.
Behavioral Analytics and UEBA Solutions:
Identifying anomalous user behavior, unusual access patterns, or abnormal service interactions indicative of trust exploitation.
Tools: Exabeam, Splunk UEBA, Securonix.
Specific Indicators of Compromise (IoCs):
Unusual cross-domain authentication events or Kerberos ticket requests.
Sudden spike in failed authentication attempts between trusted domains.
Unexpected network connections or data transfers between trusted network segments.
Presence of lateral movement tools such as BloodHound, PowerSploit, or Impacket.
Detecting exploitation of Network Trust Dependencies is critical due to the severe impact it can have on organizations, including:
Privilege Escalation Risks:
Exploiting trust relationships can allow attackers to escalate privileges rapidly, potentially gaining domain administrator or enterprise-level access.
Rapid Lateral Movement:
Trust dependencies facilitate rapid lateral movement, enabling attackers to quickly compromise multiple systems or entire network segments.
Data Exfiltration and Sensitive Information Leakage:
Attackers leveraging trusted pathways can exfiltrate sensitive data more easily, bypassing traditional perimeter security controls.
Persistence and Difficulty of Remediation:
Exploited trust relationships can enable attackers to maintain persistent access, complicating incident response and remediation efforts.
Compliance and Regulatory Implications:
Failure to detect and mitigate trust dependency exploitation can lead to compliance violations, regulatory penalties, and loss of customer trust.
Early detection enables organizations to rapidly contain and remediate threats, minimize damage, and reduce the overall impact of a security incident.
NotPetya Attack (2017):
Attack Scenario: Exploited implicit trust within internal networks, using compromised credentials and SMB protocol vulnerabilities to propagate rapidly across networks.
Tools/Techniques Used: EternalBlue exploit, credential dumping (e.g., Mimikatz), lateral movement via SMB.
Impact: Massive global disruption, billions of dollars in damages, significant operational downtime for major companies worldwide.
APT29 (Cozy Bear) Campaigns:
Attack Scenario: Exploited trust relationships between organizational domains and network segments to move laterally and escalate privileges.
Tools/Techniques Used: BloodHound, custom lateral movement scripts, credential harvesting tools.
Impact: Long-term espionage, theft of sensitive government and organizational data, difficulty in detection and remediation due to legitimate trust relationships being abused.
SolarWinds Supply Chain Attack (2020):
Attack Scenario: Attackers leveraged compromised trusted relationships between internal services and domains to move laterally and access sensitive networks and data.
Tools/Techniques Used: Custom malware (Sunburst), lateral movement via trusted service accounts, exploitation of internal trust dependencies.
Impact: Extensive compromise of multiple U.S. government agencies and private organizations, severe national security implications, long-term remediation efforts required.
FIN6 Financial Sector Attacks:
Attack Scenario: Exploited implicit trust between internal payment processing systems and corporate networks, leveraging compromised accounts to access sensitive financial data.
Tools/Techniques Used: PowerShell scripts, Impacket toolkit, credential dumping, lateral movement via SMB and RDP.
Impact: Theft of payment card data, significant financial losses, reputational damage to affected organizations.