Thread by @malmoeb

1/ We recently had an interesting #Azure case where the TA, instead of creating a new Inbox Rule, added email addresses of interest to the list of blocked senders and domains.

The incoming emails will get flagged as spam and moved to the Junk email folder. 📂

🧵

2/ Here is a screenshot from Outlook web access

(the view might differ, as, for example, here on the screenshot from the theitbros [1])

3/ And here from an Outlook client:

4/ This is a sneaky way to circumvent monitoring of audit logs which looks for specific keywords like "New-InboxRule".

Check out the excellent Business Email Compromise (BEC) guide from PwC for more keywords and background. [2]

5/ Plus, such a rule will not appear when extracting mailbox rules from the compromised account (or for all accounts for threat-hunting reasons) with the cmdlet Get-InboxRule.

6/ But we see this action in the Unified Audit Log tracked with the Operation "Set-MailboxJunkEmailConfiguration"

7/ Or we can read out the active list of blocked senders and domains with PowerShell (might return a long list of domains and addresses):

Get-MailboxJunkEmailConfiguration -Identity $Mailbox.Alias | Format-List BlockedSendersAndDomains

8/ I tweeted about the "Set-MailboxJunkEmailConfiguration" operation before, but last time, the attackers entered a whole list of mail addresses as trusted senders to facilitate receiving spam mail.

https://twitter.com/malmoeb/status/1487123634959310852

9/ Unfortunately, the client had auditing turned off - so there is no easy UAL way to backtrack the attacker's steps.

https://twitter.com/malmoeb/status/1451170811470139396

10/ Nevertheless, the TA must log into the compromised account to read the "interesting" emails received and move to the Junk-Folder (because of the Blocked Senders rule).

Thus we still have a good chance to catch the TA with the traces inside the Sign-In Logs 🎉

11/ References:

[1] theitbros.com/wp-content/upl…
[2] github.com/PwC-IR/Busines…