Consent given to application associated with business email compromise attacks in Microsoft 365
このページは日本語には対応しておりません。随時翻訳に取り組んでいます。
翻訳に関してご質問やご意見ございましたら、
お気軽にご連絡ください。
Goal
Detect when a user consents to an application associated with business email compromise.
Strategy
Monitor Microsoft 365 Exchange audit logs to look for the operation Consent to application.
. Attackers who have gained unauthorized access to a victim’s account may add applications in order to collect emails or send out further phishing emails. In this detection, we try to identify the following applications:
- eM Client - a desktop email client with full Microsoft Office 365 synchronization.
- PerfectData Software - exports mailboxes for backup purposes.
- Newsletter Software Supermailer - email newsletter software to send out high volume emails.
- SigParser - email signature contact scraping and parsing.
Triage and response
- Identify any additional unusual behaviors:
- Previous failed logins.
- Anomalous geo-location.
- VPN usage.
- Determine if there is a legitimate use case for the new application by contacting the user
{{@usr.email}}
. - If
{{@usr.email}}
is not aware of the application:- Investigate other activities performed by the user
{{@usr.email}}
using the Cloud SIEM - User Investigation dashboard. - Begin your organization’s incident response process and investigate.
Changelog
- 29 July 2024 - Added additional application ID for SigParser.
- 13 August 2024 - Added additional application to markdown.