Adversaries may install code on externally facing portals, such as a VPN login page, to capture and transmit credentials of users who attempt to log into the service. For example, a compromised login page may log provided user credentials before logging the user in to the service.
This variation on input capture may be conducted post-compromise using legitimate administrative access as a backup measure to maintain network access through External Remote Services and Valid Accounts or as part of the initial compromise by exploitation of the externally facing web service.(Citation: Volexity Virtual Private Keylogging)
Detection of Credential Harvesting via Web Portal Modification
Privileged Account Management: Privileged Account Management focuses on implementing policies, controls, and tools to securely manage privileged accounts (e.g., SYSTEM, root, or administrative accounts). This includes restricting access, limiting the scope of permissions, monitoring privileged account usage, and ensuring accountability through logging and auditing.This mitigation can be implemented through the following measures:
Account Permissions and Roles:
Credential Security:
Multi-Factor Authentication (MFA):
Privileged Access Management (PAM):
Auditing and Monitoring:
Just-In-Time Access:
Tools for Implementation
Privileged Access Management (PAM):
Credential Management:
Multi-Factor Authentication:
Linux Privilege Management:
Just-In-Time Access: