Office 365 MFA Bypass via Trusted IP Modification

Attackers are increasingly targeting cloud environments like Office 365 to bypass security controls. A common tactic involves manipulating the trusted IP list, which allows logins from specified IP addresses to bypass MFA. This method, as highlighted in Black Hat USA 2020 presentations, can be used to maintain persistence or escalate privileges within the compromised environment. The activity is typically logged within the O365 audit logs as "Set Company Information" events related to StrongAuthenticationPolicy modifications. If successful, attackers can gain persistent, stealthy access to sensitive data and systems without triggering standard MFA alerts. Defenders need to monitor changes to these trusted IP configurations closely to identify and prevent unauthorized modifications.

Attack Chain

1. An attacker gains initial access to an Office 365 account with sufficient privileges to modify tenant settings. This could be through phishing, credential stuffing, or other initial access methods.
2. The attacker authenticates to the Office 365 portal or uses PowerShell to manage the tenant configuration.
3. The attacker modifies the StrongAuthenticationPolicy by adding a new IP address or CIDR range to the trusted IPs list using the Set-MsolCompanySettings cmdlet or the O365 admin portal.
4. The event is logged as "Set Company Information" with ModifiedProperties{}.Name=StrongAuthenticationPolicy in the O365 management activity logs. The ModifiedProperties{}.NewValue field contains the newly added IP address(es).
5. The attacker uses a compromised account or a newly created account originating from the trusted IP address to authenticate to Office 365.
6. Because the login originates from a trusted IP, the MFA requirement is bypassed, allowing the attacker to gain access without additional authentication factors.
7. The attacker performs reconnaissance within the Office 365 environment, exploring sensitive data, applications, and user accounts.
8. The attacker exfiltrates sensitive data, establishes persistence, or performs other malicious activities within the compromised Office 365 environment.

Impact

Successful MFA bypass can lead to significant data breaches, financial losses, and reputational damage. Attackers can access sensitive emails, documents, and other confidential information stored within Office 365. They can also use the compromised accounts to launch further attacks against internal systems or external partners. The number of affected users and the extent of the damage depend on the attacker's objectives and the scope of access gained through the MFA bypass.

Recommendation

• Deploy the Sigma rule O365 MFA Bypass via Trusted IP Addition to detect unauthorized modifications to the trusted IP list in Office 365.
• Review and audit existing trusted IP configurations in Office 365 to ensure they are legitimate and necessary.
• Implement alerts for any changes to the StrongAuthenticationPolicy to provide real-time visibility into potential MFA bypass attempts.
• Monitor O365 management activity logs for "Set Company Information" events related to the StrongAuthenticationPolicy as described in the Overview.
• Investigate any alerts generated by the Sigma rule, focusing on the user account that made the changes and the IP addresses that were added.
• Enforce conditional access policies that require MFA even for trusted locations in specific scenarios.