CrowdStrike's latest Threat Hunting Report shows a significant surge in identity-based intrusions, with adversaries pivoting to new tactics to abuse these valid credentials to target vulnerabilities in the cloud and in software.

“We're seeing the adversary increasingly focus on identity as an attack factor,” CrowdStrike Global CTO Elia Zaitsev told SDxCentral in an interview at the Black Hat USA 2023 event, adding one of the examples is an identity-attack technique called Kerberoasting.

Kerberoasting is a post-exploitation attack technique that attempts to obtain a password hash of a Microsoft Active Directory (recently rebranded as Entra ID) account that has a service principal name, often resulting in threat actors gaining higher privileges and allowing them to remain undetected in victim environments for longer periods of time, according to CrowdStrike.

The attack is not new. “It's been around since 2014,” Zaitsev said. “It essentially takes advantage of a fundamental architectural flaw in Microsoft's Active Directory protocol. It's not a zero day, it's not a bug, you can't really fix it. It's just, unfortunately, the way the technology is designed.”

The vendor’s threat hunting report found a nearly six-times year-over-year spike in Kerberoasting identity attacks. “It seems like the adversaries have really started to figure out the relevance of it and how to take advantage of it,” he noted.

The report also showed almost two-thirds (62%) of all the interactive intrusions CrowdStrike teams tracked for the past year involved the abuse of valid credentials.

“Identity is essentially becoming one of the most popular weapons the adversaries are employing,” Zaitsev noted. “But if identity is kind of a new weapon, the cloud is the new landscape. It's the new domains, a new theater that we're seeing adversaries increasingly operate. And there is overlap between new types of identity attacks, taking advantage of things you can do in the cloud.”

As a leading endpoint security vendor, CrowdStrike built its identity module of the Falcon platform based on the vendor’s Preempt acquisition in 2020.

Zaitsev argues traditional endpoint security focuses on detecting unusual behavior, such as malware, ransomware activity and anomalous system programs. However, adversaries have realized that using these moves, tools and malware generates significant digital "noise," which endpoint technologies can detect.

“In many cases, if you're very deliberate and stealthy, just by doing behaviors that [users] would normally do, access information that [users] would normally access, you can basically stay under the radar of a lot of network, endpoint, firewall [security] technologies,” he said. “But there's one crucial thing that we can look at, which is the identity piece.”

For instance, if a person is accessing a system from Las Vegas and then, within minutes, someone using this person’s credentials is accessing a system from a different part of the world, that's an obvious anomaly. Zaitsev noted this is a simple and straightforward example of suspicious activity that not only can be detected but can also be blocked effectively.

This approach becomes “very effective” when it comes to fighting ransomware attacks. “The usage of legitimate credentials is almost always involved with ransomware attacks,” he said. “In ransomware, you always want to stop it before it runs. What's the next best thing? Stop it after it runs on the first system, and before it gets on to all the other ones. And identity protection is a key way we can lock down the adversary and, again, stop that lateral movement.”

To double down on identity security, CrowdStrike introduced its Falcon OverWatch Elite Identity Threat Hunting service during Black Hat.

This is the first new offering from the vendor’s newly-formed Counter Adversary Operations, which merged CrowdStrike Falcon Intelligence and the Falcon OverWatch threat hunting teams.

CrowdStrike claims the identity threat hunting service is designed to offer the latest intelligence on adversary tactics, techniques and procedures (TTPs) and motives based on trillions of telemetry events from the Falcon platform. This makes it possible to quickly identify and remediate compromised credentials, track lateral movement and outpace adversaries.

“What we're doing now is actually offering this threat intelligence to our customers as a service,” Zaitsev said. “Fundamentally, if our goal is to protect customers, stop them from being breached, et cetera, we believe tactically and philosophically, [they need] to see everything and to understand what's going on.

“You have to know your opponent before you can defeat them,” he added, quoting the "Art of War" by Sun Tzu.

The service is available to CrowdStrike Falcon OverWatch Elite customers without additional cost.