针对 Microsoft 环境的由专家领导的威胁侦测与响应

Summary

Detecting and neutralizing a business email compromise (BEC) attack using Microsoft Office 365 Management Activity telemetry.

• Real-world attack detected by Sophos’ proprietary threat detection rules
• Using a Sophos-Microsoft turnkey integration - included with Sophos MDR
• Microsoft E5/A5 subscription not required
• Investigated and remediated by Sophos MDR’s Microsoft Certified security analysts using custom Microsoft response playbooks 

Stage 1: Adversary activity

Adversary activity

• The attack begins with a phishing email sent to [ USER ]
• The attacker usesEvilginx, an open-source man-in-the-middle (MITM) framework used for phishing login credentials and session cookies, to obtain [ USER 1’s ] username, password, and authorization tokens, and uses the tokens to circumvent the organization’s multi-factor authentication (MFA)
• The attacker creates a new email forwarding rule in [ USER ]’s Microsoft Office 365 inbox
• Impersonating [ USER ], the attacker sends a request to [ ADMIN ]to validate the attacker’s IP address, granting access to a Microsoft Dev Box in Azure
   

Stage 2: Sophos MDR Threat Detection

Sophos MDR Threat Detection

Using Sophos’ proprietary threat detection rules:

• Sophos MDR detects the creation of new inbox rules for [ USER ]’s Microsoft 365 email account that contain only special characters
• A separate detection rule identifies multiple IP addresses and user agents used within the same session, indicating [ USER ]’s account and session have been compromised
   

Stage 3: Sophos MDR Threat Investigation

Sophos MDR Threat Investigation

Sophos MDR analysts investigate endpoint telemetry associated with [ USER ] and identify malicious behaviors and artifacts, including Mimikatz and BloodHound tools commonly used by attackers to steal sensitive data and escalate privileges within a network.

Stage 4: Sophos MDR Threat Response

Sophos MDR Threat Response

• Sophos MDR analyst isolates the compromised host and suspends [ USER ]’s account to contain the attack
• Sophos MDR analyst advises [ CUSTOMER] to reset [ USER]’s compromised credentials
• Sophos MDR analysts conduct full-scale incident response to determine initial access and remove all malicious artifacts used in the attack