tag: M365 · 5 items
- Engineer — Learn: The focus on legitimate-tool abuse and M365 session hijacking is worth understanding for defensive architecture, but the summary provides no specific CVE, misconfiguration, or patch target to act on.
- SOC/IR — Learn: A ranked threat-technique overview could sharpen triage priorities, but the summary names no specific TTPs, IOCs, or ATT&CK mappings — read the full report before deciding whether any detections warrant tuning.
- Leader — Skip
- Engineer — Plan: Active AitM campaign bypasses MFA via stolen session tokens — no patch exists, but hardening is actionable: enable Entra ID Token Protection in Conditional Access policies and audit sign-in logs for anomalous token-replay patterns since July 14, 2026.
- SOC/IR — Act: Huntress documented 497 confirmed M365 sign-in events across 79 orgs from July 14–September 22, 2026; sweep Entra ID and M365 unified audit logs for token reuse from mismatched IP geographies or device states consistent with AitM relay behavior.
- Leader — Act: M365 email accounts at 79 organizations were compromised via session-token hijacking — brief leadership now given M365’s ubiquity in your estate, confirm Entra ID token protection and phish-resistant MFA are enforced, and assess whether any internal accounts show anomalous sign-in activity.
- Engineer — Act: ConnectWise supply chain compromise explicitly triggers Act; audit your M365 tenant for unauthorized OAuth app registrations and anomalous credential grants, and verify ConnectWise installation integrity against known-good baselines.
- SOC/IR — Act: Active nation-state campaign with ATT&CK-mappable TTPs (supply chain compromise, application credential abuse); hunt for anomalous OAuth app registrations and unexpected delegated permission grants in M365 unified audit logs going back at least 90 days, and pull the full Microsoft post for Sentinel/Defender detection queries.
- Leader — Act: Nation-state supply chain compromise via a widely-used MSP tool affecting M365 tenants qualifies as a systemic event; verify whether ConnectWise is in your environment directly or via a managed service provider, request a formal exposure attestation from ConnectWise, and brief leadership given the nation-state attribution before they see it in the news.
- Engineer — Act: If ConnectWise Cloud Backup or any of the seven disabled application identities are authorized in your Azure AD/Entra tenant, immediately revoke those OAuth consent grants and audit M365 unified audit logs for unauthorized data access using the published application identity GUIDs.
- SOC/IR — Act: Hunt M365/Entra audit logs for activity by the compromised ConnectWise application identity GUIDs (e.g., 506e08f9-6e9a-4da4-942b-a099a03644ae) — focus on anomalous OAuth token issuance, mailbox access, and SharePoint reads since the earliest possible compromise window.
- Leader — Act: Confirm whether ConnectWise Cloud Backup or related products are used by your organization; if so, request ConnectWise’s incident report, assess M365 tenant exposure, and evaluate whether any data access triggers breach-notification obligations.
- Engineer — Act: If your org or your MSP uses ConnectWise Cloud Backup (formerly SkyKick), audit M365 unified audit logs and sign-in logs immediately for delegated-access activity from ConnectWise service accounts, and review/revoke any delegated admin permissions granted to ConnectWise.
- SOC/IR — Act: Active campaign accessing M365 tenants via compromised MSP tool credentials — hunt M365 sign-in logs for authentication events tied to ConnectWise Cloud Backup service principals or delegated admin access since this campaign began, and alert on anomalous third-party delegated logins.
- Leader — Act: If your organization uses an MSP that relies on ConnectWise Cloud Backup, confirm your exposure this week by requesting an attestation from that vendor; 173 confirmed tenant compromises via a single supply-chain credential is a board-question-level supply chain trust event.