Privileged users sign in with phishing-resistant methods

Overview

Without phishing-resistant authentication methods, privileged users are more vulnerable to phishing attacks. These types of attacks trick users into revealing their credentials to grant unauthorized access to attackers. If non-phishing-resistant authentication methods are used, attackers might intercept credentials and tokens, through methods like adversary-in-the-middle attacks, undermining the security of the privileged account.

Once a privileged account or session is compromised due to weak authentication methods, attackers might manipulate the account to maintain long-term access, create other backdoors, or modify user permissions. Attackers can also use the compromised privileged account to escalate their access even further, potentially gaining control over more sensitive systems.

Remediation

• Get started with a phishing-resistant passwordless authentication deployment
• Ensure that privileged accounts register and use phishing resistant methods
• Deploy a Conditional Access policy to target privileged accounts and require phishing resistant credentials
• Monitor authentication method activity

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	High
Effort to fix	Medium
Impact on users	Low
Pillar	Identity
Category	Privileged access
Product	Entra ID
Feature	Conditional Access
Area	Privileged access
ATT&CK	T1566.002 Spearphishing Link, T1557 Adversary-in-the-Middle, T1078.004 Cloud Accounts
Licence	P1
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.