Rapid Response to Microsoft 365 Security Incidents

After initial detection of the incident, speed is of utmost importance to prevent further damage and impact on your organization, like data loss or reputational damage. In past incidents we have seen exfiltration of emails and SharePoint data, further internal phishing or even frauds in the six figures with only one compromised cloud identity.

Without rapid and adequate containment measures, a small incident quickly develops to a high-impact incident. Hence contact our IR experts as soon as possible after the initial detection via our emergency hotline +49 89 890 63 62 61 or submit a request here.

Microsoft Cloud incident are usually detection with alerts from Microsoft Defender suite, foremost Microsoft's Identity protection. Typical alerts you might see are:

• Atypical travel
• Anomalous Token
• Suspicious browser
• Unfamiliar sign-in properties
• Malicious IP address
• Suspicious inbox manipulation rules
• Password spray
• Impossible travel
• New country
• Activity from anonymous IP address
• Suspicious inbox forwarding
• Mass Access to Sensitive Files
• Verified threat actor IP
• Additional risk detected
• Anonymous IP address
• Admin confirmed user compromised
• Microsoft Entra threat intelligence
• Possible attempt to access Primary Refresh Token (PRT)
• Anomalous user activity
• User reported suspicious activity
• Suspicious API Traffic
• Suspicious sending patterns
• Leaked credentials
• Microsoft Entra threat intelligence
• Token issuer anomaly
• Unusual volume of external file sharing
• Messages have been delayed

When seeing some of these alerts in your environment you should take them seriously and take immediate response actions.​

Over the last years many organizations have identified multifactor authentication (MFA) as a very important security measure to protect user accounts.

In the past any MFA method was sufficient to protect an enterprise from most phishing threats. With MFA becoming more and more widespread adversaries have adapted their phishing attacks accordingly.

Today it is common for attackers to use Adversary-in-the-Mittle (AitM), also known as Man-in-the-Middle (MitM) phishing websites that can circumvent the protection by non-phishing-resistant MFA methods like SMS tokens, TOTPs or mobile app push notifications.

During both phishing attacks the user is first lead to a phishing website and deceived to enter their credentials. During common  phishing, the attackers simply save the users credentials for later use. AitM- the more sophisticated variant – uses a malicious proxy server that hosts the phishing page.

This proxy is used to dynamically forward the login information of the user towards Microsoft in real-time to trigger an authentication process and the corresponding MFA mechanisms.

Depending on the MFA method of the user the phishing page then displays whatever prompt, form or information the real Microsoft page would display to the user. This way the user can complete the MFA process on the phishing page which is then again forwarded to Microsoft by the attacker.

The resulting multifactor authenticated session token is kept by the attacker and not forwarded to the user.

Since most cloud incident still start with an initial phishing mail, the best way to prevent such incidents if the implementation of multi-factor authentication, included phishing-resistant factors, in combination with a comprehensive awareness campaign.