Listen to this Post
Source: RadioCSIRT Episode 261
You Should Know:
1. Microsoft Entra’s MACE Credential Revocation Issues
Microsoft Entra’s new MACE Credential Revocation feature has triggered widespread account lockouts due to false positives, bypassed MFA, and erroneous alerts. Admins report systemic challenges.
Commands to Diagnose & Mitigate:
Check Azure AD sign-in logs for lockout events Get-AzureADAuditSignInLogs -Filter "status/errorCode eq '50057'" -Top 100 Unlock a user account (Exchange Online) Unlock-Mailbox -Identity "[email protected]" Verify MFA status for a user Get-MsolUser -UserPrincipalName "[email protected]" | Select-Object StrongAuthenticationMethods
PowerShell Automation to Monitor Lockouts:
Script to alert on unusual lockouts
$lockouts = Get-AzureADAuditSignInLogs -Filter "status/errorCode eq '50057'" -Top 50
if ($lockouts.Count -gt 10) {
Send-MailMessage -To "[email protected]" -Subject "ALERT: Excessive Account Lockouts" -Body "Investigate MACE false positives."
}
2. CISA’s Clarification on CVE Program
The CISA reaffirmed support for the CVE Program, critical for vulnerability management. Admins should sync with CVE databases.
Linux Commands to Query CVEs:
Fetch CVE data via NVD API curl -s "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2024-1234" | jq . Scan for vulnerabilities with OpenVAS openvas-start openvasmd --get-vulns --filter "threat>High"
Windows Exploit Check (via CVE):
Use Nessus or WMI to check patches
Get-HotFix | Where-Object { $_.Description -match "CVE-2024" }
What Undercode Say
- Microsoft Entra Admins: Disable MACE temporarily via
Set-MsolDomainFederationSettings -DomainName "domain.com" -PreferredAuthenticationProtocol "WsFed". - CVE Tracking: Automate CVE updates with `cron` jobs or Azure Automation:
Daily CVE sync script wget -O /var/cve-db/nvd-update.json https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-modified.json
- Logging: Forward Azure AD logs to SIEMs (e.g., Splunk/ELK) for real-time analysis:
Syslog forwarding (Linux) rsyslogd -f /etc/rsyslog.d/azure-ad.conf
- MFA Bypass Mitigation: Enforce FIDO2 or Temporary Access Pass for critical roles.
Expected Output:
- Microsoft Entra: Audit logs + PowerShell mitigation scripts.
- CVE Program: Automated CVE tracking + OpenVAS/Nessus scans.
- SIEM Integration: Centralized logging for threat detection.
Relevant URLs:
References:
Reported By: Marcfredericgomez Cybersecurite – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
