Learn how to detect, respond, and escalate to prevent further compromise for account hijacks. Get Darktrace's expert insights on cybersecurity strategies.
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Lydiane-Ashley Belle
Cyber Security Analyst
Share
21
Feb 2023
As the prevalence of Software-as-a-Service (SaaS) and multi-factor authentication (MFA) as a primary vector of attack continues across a variety of organizations and of every size in multiple industries, it is more important now than ever for organizations to utilize every tool at their disposal to mitigate account compromise at the earliest possible stage.
Having incident response is helpful, but when depending on human analysts to react to and appropriately respond to a huge variety of threats there will no doubt be gaps and those gaps can lead to disaster. Having not only an automated response capability, but an intelligent autonomous decision maker which can respond and actively escalate actions as events unfold is paramount to preventing compromise.
In November 2022, Darktrace responded in real time to a threat actor that had gained access to a customer email account and created a new email rule in an attempt to conceal their activity, all while sending their own outbound malicious emails.
This blog explores how Darktrace uses autonomous response (RESPOND) technology to instantaneously stop the hijacking of a customer SaaS account, without causing any major disruption to their business operations.
Details of Attack Chain
The initial compromise took place when a threat actor logged in from Florida, United States, an unusual location compared to the account holder’s expected login location in the United Arab Emirates. Just over an hour later, a new email rule was created from the same unusual IP address. This rule moved all emails originating from alansari[.]ae, a domain associated with a money transfer service that the account holder had occasionally used, into the “Conversation History” folder and marked them as read. Thereafter, the user began to receive malicious spoof emails purporting to be from alansari[.]ae. This example of social engineering highlights a low effort, high yield method many threat actors employ which relies on the trust of users in known correspondents and services, making it harder to identify and mitigate spoofing in phishing.
Figure 1: Darktrace DETECT showing the unusual login location in Florida, United States, compared to the account holder's expected login location in the United Arab Emirates.
This anomalous activity triggered an Enhanced Monitoring model, whereupon the Darktrace SOC team sent a Proactive Threat Notification (PTN) to the customer, alerting the security team to this attempted account compromise. Darktrace RESPOND automatically forced the user to log out and subsequently disabled the account, while the Darktrace SOC team assessed the incident and liaised with the customer. These two actions performed in tandem added immense value for the security team who were given time to further investigate this incident while preventing further abuse of the compromised account. RESPOND was able to analyze the pattern of behavior and escalate its action in accordance with the specifics of the observed attack instantaneously, which could have taken human teams’ hours of analysis.
Figure 2: Image demonstrating the actions taken by Darktrace RESPOND in response to the suspicious activity detected on the device in question. The first action was a forced log out, which was followed up by the account being disabled.
The Darktrace SOC team determined that the purpose of this email rule creation was to conceal legitimate incoming emails from the money transfer service, while sending spoofed emails to induce the account holder to send money to the threat actor.
Three days after the initial compromise, Darktrace observed one such spoofed email claiming to be from alansari[.]ae. However, it was immediately placed in the junk folder by Darktrace RESPOND, again demonstrating the effectiveness and immediacy of autonomous RESPOND actions. Given the account holder had a history of receiving emails from the money transfer service, it is likely that without the instant and autonomous actions of Darktrace RESPOND they may have fallen victim to the attacker’s attempt.
Conclusion
Ultimately, Darktrace RESPOND demonstrated its automated response capabilities and its autonomous decision allowed it to detect and respond to an account compromise at the initial compromise stage, preventing the attacker from stealing funds from the account holder.
By enabling autonomous response, the human security team was freed up to provide deeper investigation into the incident and mitigation, while ensuring the threat actor was not able to further exploit the privileges of the account.
Although this compromise focused on funds being embezzled from an individual, this intrusion could have easily escalated to a more widespread breach of client data. Safeguarding customer networks requires rapid response and an intelligent decision maker able to respond to ongoing incidents and escalate actions at the earliest stage.
The Darktrace suite of products, including RESPOND and its dedicated SOC team and services, provides autonomous and instantaneous protection from attackers before they can leverage compromised accounts to further penetrate a network, or exfiltrate sensitive company data.
Credit to: Brianna Leddy, Director of Analysis and Lydiane-Ashley Belle, Cyber Security Analyst.
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
From VPS to Phishing: How Darktrace Uncovered SaaS Hijacks through Virtual Infrastructure Abuse
Darktrace identified coordinated SaaS account compromises across multiple customer environments. The incidents involved suspicious logins from VPS-linked infrastructure followed by unauthorized inbox rule creation and deletion of phishing-related emails. These consistent behaviors across devices point to a targeted phishing campaign leveraging virtual infrastructure for access and concealment. Discover how Darktrace uncovered this activity and what it means for the future of SaaS security.
Defending the Cloud: Stopping Cyber Threats in Azure and AWS with Darktrace
This blog examines three real-world cloud-based attacks in Azure and AWS environments, including credential compromise, data exfiltration, and ransomware detonation. Learn how Darktrace’s AI-driven threat detection and Autonomous Response capabilities help organizations defend against evolving threats in complex cloud environments.
Top Eight Threats to SaaS Security and How to Combat Them
SaaS security requires new methods to keep up with evolving threats and business infrastructure. In this blog, learn the top eight threats to identity security and how AI-based solutions can help.
“I wonder if running that tool influenced the connectivity in some way.”
“I might need to target down or reboot, but first, I'll investigate the network using ARP. I wonder if ARP is responding properly. If I see "ip neigh stale," that could indicate a problem. I think arping might help in this situation, but I’ll need to keep an eye on how the network is behaving. It's all about figuring out where the issue lies!”
図10：エージェントの異常なLDAPアクティビティに対してトリガーされたこのLinuxサーバーに対するモデル検知は、Cyber AI Analystによって自律的に調査され、その調査結果にはエージェントの異常なSMBセッションアクティビティに関する内容が含まれ、Cyber AIAnalystインシデントに記録されました。
DarktraceのCyber AI Analystは、エージェントのアクティビティによってトリガーされたモデル検知を自律的に調査し、その調査結果を1つの重要なインシデントレポートにまとめました。インシデント報告書の内容は、エージェントによるネットワークスキャンから始まりコーディング演習内容のSMBベースの上書きで終わる、エージェントの行動の各段階を詳しくカバーしています。
図20：Cyber AI Analystは、モデル検知に対する自律的な調査を通じて得られた所見をつなぎ合わせ、エージェントの進行状況のタイムラインを作成し、アクティビティを視覚的に表したグラフとともに提供しました。
Cyber Verification Program下のAnthropic Opus 4.6モデルなど、他のフロンティアモデルを使用したエージェントも、Darktraceのシミュレートされた環境で同じ設定とタスクを使ってテストされました。反復の度に、エージェントは演習の内容または採点プログラムを変更して不正を行おうとしました。基盤となるモデルに関係なく、エージェントは自分が置かれた環境を侵害することで、100％のスコアを達成する方法を見つけることに成功していました。これらのエージェントによるハッキングは、アクティビティの内容こそ違っていましたが、すべてその環境のベースラインの振る舞いから大きく逸脱した動作を引き起こしていました。これらの逸脱はDarktraceプラットフォームに十分な検知の機会を提供し、エージェントの逃げ場はありませんでした。
エージェンティックハーネスは会話履歴をローカルに保存しますが、ダークトレースの研究者たちは、保存されたAIの応答が本当にモデルによって生成されたものであるかどうかの検証が行われていないことを発見しました。また、この設計上の選択がAnthropic Claude Code、AWS Kiro-CLI、OpenAI Codex、およびオープンソースのPiにわたって共通していることを確認しました。
会話履歴は多くの場合クライアント側に保存されます。例えば、Anthropic Claude Code、OpenAI Codex、AWS Kiro-CLI、Piなどでもそうです。そのため、ユーザーはセッションを自由に再開でき、一部の製品にはその履歴を操作する機能が組み込まれています。たとえば、会話の中の特定の時点に戻り、送信したメッセージを編集して、会話を別の軌道へ進めていくことができます。きわめて重要な点として、私たちが調査したすべてのケースにおいて、保存されているAIの応答が対応するモデルから生成されたものであり改ざんされていないことの検証は行われていませんでした。
