Read on Twitter
Top 3 #M365 Account Takeover (ATO) actions spotted by our SOC in Q1:
1. New-inbox rule creation to hide attacker emails
2. Register new MFA device for persistence
3. Create mailbox forwarding rules to monitor victim comms and intercept sensitive info
More details in 🧵...
1. New-inbox rule creation to hide attacker emails
2. Register new MFA device for persistence
3. Create mailbox forwarding rules to monitor victim comms and intercept sensitive info
More details in 🧵...
50% of ATO activity in M365 we identified was for New-inbox rules created by an attacker to automatically delete certain emails from a compromised account. By deleting specific emails, an attacker can reduce the chance of the victim or email admins spotting unusual activity.
25% percent of ATO activity we identified was for the registration of a new MFA device in Azure. Registering a new MFA device allows an attacker to maintain persistence.
We're seeing more and more M365 session cookie theft for initial access....
We're seeing more and more M365 session cookie theft for initial access....
Once an attacker accesses the email account, they typically query the inbox for the phishing emails that contains a link to their proxy site. Then, they move the email to the deleted items folder to cover their tracks. Finally, they register a new MFA device for persistence.
The creation of new mailbox forwarding rules to automatically forward emails to an attacker controlled account to monitor victim email communications and intercept sensitive information account for 5% of the ATO activity we identified in M365.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
