Full Report
Discover how our new Unwanted Access capability strengthens your defenses against session hijacking and credential theft. Dive in and learn how to minimize risks and protect your business-critical assets from evolving cyber threats.
Analysis Summary
# Best Practices: Session Hijacking and Credential Theft Prevention
## Overview
These practices address the growing threat of **Identity-based attacks**, specifically focusing on **Session Hijacking** and **Credential Theft**. As traditional password-based security falters, these measures aim to secure the "identity attack surface" by monitoring Microsoft 365 environments for unauthorized access patterns and automating the response to hijacked sessions.
## Key Recommendations
### Immediate Actions
1. **Define Location Baselines:** Identify geographic regions where your employees legitimately work and create "Expected" location lists.
2. **Blacklist High-Risk Regions:** Explicitly mark countries or regions where your organization has no business presence as "Unauthorized" to trigger immediate SOC alerts.
3. **Audit VPN Usage:** Inventory authorized corporate VPNs and flag all others (e.g., commercial "anonymizing" VPNs) as unauthorized.
### Short-term Improvements (1-3 months)
1. **Deploy ITDR (Identity Threat Detection and Response):** Implement managed detection services that analyze Microsoft 365 events and organize them into "sessions" rather than isolated login events.
2. **Refine Configuration Rules:** Granularly apply access rules at the **Account**, **Organization**, and individual **Identity** levels to account for specialized users (e.g., traveling executives or remote contractors).
3. **Establish an Escalation Workflow:** Define internal points of contact who can quickly respond to "Escalations"—requests from a SOC to verify if an unusual login was legitimate or malicious.
### Long-term Strategy (3+ months)
1. **Implement Identity Isolation:** Move toward a framework where suspicious identities can be isolated automatically to prevent lateral movement and data exfiltration.
2. **Baseline Behavioral Identity:** Move beyond static rules to behavioral analysis, identifying "out of the ordinary" actions even from "Expected" locations or VPNs.
3. **Continuous Monitoring of AS-Based Infrastructure:** Monitor for login attempts originating from Datacenter infrastructure (AS-based detection) rather than residential or corporate IPs, a common tactic in advanced session hijacking.
## Implementation Guidance
### For Small Organizations
- Focus on **Geofencing**: Since small teams usually operate in limited locations, "Unauthorized" location rules provide the highest ROI in noise reduction and security.
### For Medium Organizations
- Implement **VPN Whitelisting**: Ensure all remote access is routed through approved tunnels. Use "Escalation" flags to train the system on the difference between a traveling employee and a credential thief.
### For Large Enterprises
- Utilize **Hierarchical Rule Application**: Set broad "Expected" rules at the account level, while applying stricter, identity-level restrictions for high-value targets (e.g., IT Admins or C-Suite) who handle sensitive assets.
## Configuration Examples
*While specific CLI code was not provided in the source, the following logic applies to the Huntress ITDR/M365 environment:*
* **Location Rule:** `Action: ALLOW | Region: United States | Level: Account-Wide`
* **Location Rule:** `Action: DENY/ALERT | Region: Egypt | Level: Organization-Wide`
* **VPN Rule:** `Action: UNAUTHORIZED | Provider: "YouShallNotPass VPN" | Level: Identity (Global)`
## Compliance Alignment
* **NIST Cybersecurity Framework (CSF):** Aligns with the **Protect** (Identity Management and Access Control) and **Detect** (Detection Processes) functions.
* **CIS Controls:** Directly supports **Control 5 (Account Management)** and **Control 6 (Access Control Management)**.
* **ISO/IEC 27001:** Relates to **A.9 (Access Control)**, ensuring only authorized users gain access to systems.
## Common Pitfalls to Avoid
* **Set-and-Forget Mentality:** Failing to update "Expected" locations when employees travel leads to high volumes of false-positive escalations.
* **Ignoring VPN Sign-ins:** Assuming a login is safe just because it uses a VPN; attackers frequently use VPNs to mask their true origin.
* **Treating Escalations as Incidents:** Escalations are information-gathering steps. Overreacting to an escalation before verification can lead to unnecessary business disruption.
## Resources
* **Huntress Managed ITDR:** hxxps[://]www[.]huntress[.]com/platform/managed-detection-and-response-for-microsoft365
* **IBM X-Force Threat Intelligence Index:** Reference for credential theft statistics.
* **MITRE ATT&CK Framework:** Guide for understanding Credential Theft techniques (T1003).
* **Huntress Support Portal:** hxxps[://]support[.]huntress[.]io/hc/en-us