(Yes, I know it’s supposed to sign them in automatically. It doesn’t always. We’ve got tickets in. What does work every time is signing into Office when prompted.)
(Yes, I know it’s supposed to sign them in automatically. It doesn’t always. We’ve got tickets in. What does work every time is signing into Office when prompted.)
The actual install isn’t really important for an attacker, just the user making the attempt. The payload will exists beside the software installer and will be launched by the user running some sort of “install” batch file or executable. It won’t install anything, it’ll dump files in places like %TEMP% and add something to the user’s RUN registry entry. It’s also why I mentioned a “laptop”. What the attacker is really after isn’t the Citrix server (that would be nice to pop, but it’s not necessary) it’s the user’s local system. That’s going to provide a beachhead on the network for the attacker to work out from. It will also provide a treasure trove of credentials the attacker can sell or use elsewhere to attack the environment (infostealers don’t need, or even ask for, local admin). Even just being able to sell access to one compromised laptop is a win for the attacker. Access brokers can sell that off to more advanced groups who will come back and try to move out from there.
But wait, we have MFA everywhere! Are you sure, are you really, really sure you don’t have a dev team somewhere who decided to hang something out on a poorly documented corner of the network and they disabled MFA on the device for a test, and then forgot to shutdown the test equipment? Because ya, I’ve worked incidents where exactly that happened.