https://feed.craftedsignal.io/tags/inbox-rule/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 03 Jan 2024 15:00:00 +0000https://feed.craftedsignal.io/briefs/2024-01-03-o365-inbox-rule-creation/Wed, 03 Jan 2024 15:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-03-o365-inbox-rule-creation/This brief outlines the detection of malicious Office 365 inbox rule creation, where attackers leverage 'New-InboxRule' and 'Set-InboxRule' operations to forward, delete, or obfuscate emails, potentially leading to data exfiltration or business email compromise.Attackers frequently abuse Office 365 inbox rules to surreptitiously forward sensitive emails to external accounts, delete evidence of their presence, or redirect communications for business email compromise (BEC) campaigns. This analytic focuses on identifying anomalous creations or modifications of inbox rules through the 'New-InboxRule' and 'Set-InboxRule' operations. This activity is logged within the Office 365 Management Activity API. The detection specifically looks for rules that enable forwarding ('ForwardTo', 'ForwardAsAttachmentTo', 'RedirectTo'), deletion ('DeleteMessage', 'SoftDeleteMessage'), or moving/copying ('MoveToFolder', 'CopyToFolder') actions, as these are commonly used in malicious campaigns. Defenders should prioritize investigating new inbox rules configured with these actions, especially when coupled with suspicious source IP addresses or unusual user behavior.

Attack Chain

1. Initial Compromise: The attacker gains access to a user's Office 365 account, potentially through phishing, credential stuffing, or other means.
2. Authentication: The attacker authenticates to Office 365 using the compromised account, generating authentication logs.
3. Rule Creation/Modification: The attacker uses the 'New-InboxRule' or 'Set-InboxRule' cmdlets via PowerShell or the Office 365 portal to create or modify an inbox rule.
4. Forwarding Rule Configuration: The rule is configured to forward emails matching specific criteria (e.g., from specific senders, containing certain keywords) to an external email address controlled by the attacker using 'ForwardTo', 'ForwardAsAttachmentTo', or 'RedirectTo' parameters.
5. Deletion/Obfuscation Rule Configuration: Alternatively, the attacker configures the rule to delete or move specific emails to prevent the legitimate user from noticing suspicious activity using 'DeleteMessage', 'SoftDeleteMessage', 'MoveToFolder', or 'CopyToFolder' parameters.
6. Data Exfiltration: Emails matching the rule's criteria are automatically forwarded to the attacker's external account, enabling data exfiltration.
7. Covering Tracks: The attacker may delete logs or modify other settings to further obscure their activity.
8. Continued Monitoring: The attacker monitors the forwarded emails for valuable information, such as financial data, intellectual property, or sensitive communications, potentially leading to further attacks or extortion.

Impact

Successful exploitation of Office 365 inbox rules can lead to significant data breaches, financial losses, and reputational damage. Attackers can exfiltrate sensitive information, intercept financial transactions, and compromise confidential communications. Business Email Compromise (BEC) attacks frequently leverage this technique. Depending on the compromised account's role, the scope of the impact can range from individual data theft to enterprise-wide breaches, potentially affecting thousands of users.

Recommendation

• Enable and monitor the Office 365 Management Activity API logs to capture 'New-InboxRule' and 'Set-InboxRule' events, as described in the overview section.
• Deploy the Sigma rules provided in this brief to your SIEM and tune them for your specific Office 365 environment.
• Investigate any alerts generated by these rules, paying close attention to the user account, source IP address ('src' field in the Sigma rules), and the parameters used in the inbox rule creation/modification, focusing on the 'Parameters{}.Name' field.
• Implement multi-factor authentication (MFA) for all Office 365 accounts to mitigate the risk of account compromise, which is a prerequisite for this attack.
• Educate users on the risks of phishing and other social engineering techniques to prevent initial account compromise.
• Review and audit existing inbox rules regularly to identify any suspicious or unauthorized configurations.

]]>highadvisoryo365inbox-ruleemaildata-exfiltrationbusiness-email-compromisehttps://feed.craftedsignal.io/briefs/2024-01-m365-exchange-inbox-rule/Wed, 03 Jan 2024 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-m365-exchange-inbox-rule/Detection of new Microsoft 365 Exchange inbox forwarding rules indicating potential unauthorized email interception and exfiltration by attackers.Attackers can exploit Microsoft 365 Exchange inbox rules to intercept and exfiltrate email data. The abuse involves creating forwarding rules that redirect emails to external, attacker-controlled addresses without proper authorization. This technique allows attackers to gain access to sensitive information without making organization-wide configuration changes or needing elevated privileges. The detection focuses on successful creation or modification events of inbox rules where forwarding parameters are set to external domains, as specified in the o365.audit.Parameters field. The scope includes any Microsoft 365 environment utilizing Exchange Online, providing a mechanism to detect and respond to potential business email compromise (BEC) attempts.

Attack Chain

1. Initial Access: An attacker gains access to a legitimate user's Microsoft 365 account, potentially through phishing or credential compromise.
2. Rule Creation/Modification: The attacker creates or modifies an inbox rule within the user's Exchange Online mailbox using New-InboxRule or Set-InboxRule.
3. Forwarding Configuration: The rule is configured to forward emails based on specific criteria (e.g., all emails, emails from specific senders) to an external email address via ForwardTo, ForwardAsAttachmentTo, ForwardingAddress, ForwardingSmtpAddress, or RedirectTo.
4. Persistence: The inbox rule remains active, automatically forwarding emails that meet the defined criteria to the attacker's address.
5. Data Exfiltration: Sensitive information is continuously exfiltrated as emails are forwarded to the external address.
6. Covert Operation: The attacker may delete or hide the rule to avoid detection, although this detection focuses on the initial creation.

Impact

Successful exploitation can lead to significant data breaches, loss of sensitive information, and financial losses due to business email compromise. The impact can range from individual data leaks to compromise of intellectual property and confidential business communications. Without detection, attackers can maintain persistent access to sensitive email data, potentially impacting hundreds or thousands of mailboxes.

Recommendation

• Deploy the Sigma rule "M365 Exchange Inbox Forwarding Rule Created" to your SIEM and tune for your environment to detect the creation of suspicious inbox rules.
• Investigate any alerts generated by the Sigma rule by reviewing the o365.audit.Parameters in the logs, focusing on the forwarding email addresses.
• Review and update email security policies to restrict and monitor the creation of forwarding rules, as mentioned in the references.
• Enable multi-factor authentication (MFA) for all users to prevent unauthorized account access, reducing the risk of inbox rule manipulation.

]]>mediumadvisoryo365exchangeinbox-ruleemail-forwardingdata-exfiltration