Attack Chain

1. Initial Access: The attacker gains access to a user's credentials, either through phishing, credential stuffing, or by compromising a Primary Refresh Token (PRT). (T1566, T1110)
2. Token Exploitation: The attacker uses the compromised OAuth refresh token or PRT to authenticate to the Microsoft Graph API.
3. Application Registration (Optional): The attacker might register a malicious application within Azure AD to facilitate access. (Not explicitly covered but a possibility.)
4. Graph API Interaction: The attacker makes requests to the Microsoft Graph API, specifically targeting email resources using email-related scopes such as Mail.Read, Mail.ReadWrite, or Mail.Send.
5. Email Access: The attacker accesses sensitive email data, potentially reading inbox contents, sending emails, or enumerating mail folders via the /me/mailFolders/inbox/messages or /users/{user_id}/messages endpoints. (T1114)
6. Data Exfiltration/Manipulation: The attacker exfiltrates sensitive information or manipulates email content for malicious purposes.
7. Persistence: The attacker maintains access by continuously using the compromised token or by establishing new persistence mechanisms.

Impact

A successful attack can lead to significant data breaches, financial losses, and reputational damage. Attackers can gain unauthorized access to sensitive email communications, intellectual property, and customer data. Business email compromise (BEC) is a likely outcome, enabling attackers to conduct fraudulent activities. The number of potential victims is vast, encompassing any organization using Microsoft 365 and relying on Azure Active Directory (Entra ID) for authentication.

Recommendation

• Deploy the Sigma rule Unusual Graph API Email Access by Client and User to your SIEM to detect anomalous access patterns. Tune the rule by allowlisting known good app_id and user_principal_object_id combinations to reduce false positives.
• Investigate any alerts generated by the Sigma rule by examining the azure.graphactivitylogs.properties.app_id, user.id, source.ip, and azure.graphactivitylogs.properties.scopes fields in the logs.
• Implement Conditional Access policies to restrict OAuth consent and risky sign-ins, mitigating the initial access vector. Refer to the references for guidance.
• Regularly audit and review application permissions within Azure AD to identify and remove any suspicious or overly permissive applications.
• Monitor azure.auditlogs and azure.signinlogs for recent application grants and risky sign-ins occurring before or after email access.
• Block known malicious applications by azure.graphactivitylogs.properties.app_id in your Azure AD tenant based on threat intelligence feeds.