Full Report
Learn more about the initial access techniques observed by the Huntress SOC and Tactical Response teams! Gain valuable insights to help you protect your environment.
Analysis Summary
# Tool/Technique: Compromised Valid Accounts (RDP & VPN)
## Overview
Based on findings from the Huntress Tactical Response team, the primary method for initial access in modern business environments shifts away from complex zero-day exploits toward the abuse of **Valid Accounts**. Threat actors prefer using stolen or compromised credentials to log into Remote Desktop Protocol (RDP) and Virtual Private Network (VPN) interfaces, as this method "flies under the radar" of traditional security alerts by mimicking legitimate user behavior.
## Technical Details
- **Type**: Technique (Initial Access)
- **Platform**: Windows (RDP), Various Network Appliances (VPN)
- **Capabilities**: Remote access, lateral movement, persistence, and bypass of perimeter defenses.
- **First Seen**: Ongoing (Highlighted in December 2024 report).
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1078 - Valid Accounts]
- [T1133 - External Remote Services]
- **[TA0006 - Credential Access]**
- [T1110 - Brute Force]
- [T1110.003 - Password Spraying]
- **[TA0008 - Lateral Movement]**
- [T1021.001 - Remote Desktop Protocol]
## Functionality
### Core Capabilities
- **Authentication Bypass**: Utilizing legitimate credentials (usernames/passwords) to bypass external firewalls via VPN or RDP.
- **Stealthy Entry**: Avoiding the "noisy" signatures associated with software exploitation or malware delivery.
- **Direct Network Access**: Gaining an immediate foothold within the internal network, often with the privileges of the compromised user.
### Advanced Features
- **Initial Access Brokering (IAB)**: Actors specifically compromise these accounts to sell access to Ransomware-as-a-Service (RaaS) affiliates.
- **Living off the Land (LotL)**: Using built-in administrative tools once logged in to avoid triggering EDR alerts based on file signatures.
## Indicators of Compromise
- **File Hashes**: N/A (Technique focuses on legitimate binary usage).
- **File Names**: `mstsc.exe` (client), `termsrv.dll` (service).
- **Network Indicators**:
- Logins from atypical geographic locations.
- Logins at unusual hours for specific user profiles.
- Connection attempts from known VPS providers or VPN exit nodes (e.g., Tor, commercial VPNs).
- **Behavioral Indicators**:
- Successful logins following a high volume of failed attempts (Brute Force).
- Single accounts logging into multiple workstations in a short timeframe.
- Clearing of Security Event Logs (Event ID 1102).
## Associated Threat Actors
- **Dragonforce** (Associated with CitrixBleed and credential abuse).
- **Initial Access Brokers (IABs)**.
- Various RaaS (Ransomware-as-a-Service) affiliates.
## Detection Methods
- **Behavioral Detection**: Monitoring for "Impossible Travel" (logins from two distant locations in a time frame that makes travel impossible).
- **Log Analysis**: Monitoring Windows Event Logs (ID 4624 for successful logins, ID 4625 for failures) specifically for Logon Type 10 (RDP).
- **Volume Analysis**: Detecting password spraying by monitoring for one IP attempting to log into many different accounts.
## Mitigation Strategies
- **Multi-Factor Authentication (MFA)**: Implementing robust MFA (preferably FIDO2/Hardware-based) on all VPN and RDP entry points.
- **Attack Surface Reduction**: Disabling RDP on the external perimeter; requiring a VPN to access RDP hosts.
- **Account Lockout Policies**: Implementing thresholds for failed login attempts to thwart brute force attacks.
- **Geofencing**: Restricting login capabilities to specific geographic regions where employees are located.
## Related Tools/Techniques
- **CitrixBleed (CVE-2023-4966)**: Used to hijack existing sessions to bypass MFA.
- **Password Spraying**: A common precursor to obtaining the "Valid Accounts" used in these attacks.
- **ADFind / BloodHound**: Tools often deployed by actors immediately after gaining access via RDP/VPN to map the network.