Adithya V

6 followers · 5 following · 958 views

on the atlas · 71

highlights · 3387

For applications using access tokens, the user loses access when the access token expires. For applications that use session tokens, the existing sessions end as soon as the token expires. If the disabled state of the user is synchronized to the application, the application can automatically revoke the user's existing sessions if it's configured to do so. The time it takes depends on the frequency of synchronization between the application and Microsoft Entra ID.
Revoke user access in an emergency in Microsoft Entra ID - Microsoft Entra ID | Microsoft Learn
Once the application issues its own session token, the application controls access based on its authorization policies.
Revoke user access in an emergency in Microsoft Entra ID - Microsoft Entra ID | Microsoft Learn
The adversaries eventually logged into the My Profile application identified by the application ID 8c59ead7-d703-4a27-9e55-c96a0054c8d2, which displays some of the user’s account information such as job title, sign-in data, and devices used. Exactly what they viewed (or potentially modified) within this application was not displayed in any log we had available to us at the time. However, we suspect it was part of their account reconnaissance steps as we’ve also witnessed this pattern in other account compromises.
Exposing and shutting down an inbox heist in action
Be sure to note forwarding addresses to suspicious external domains, such as phishing domains or personal email accounts.
Microsoft 365: Identifying Mailbox Access | Aon
In Stroz Friedberg’s testing, mail items accessed via applications were associated with bind events and log the specific message IDs associated with those events.
Microsoft 365: Identifying Mailbox Access | Aon
Upon unauthorized access into a mailbox, sync operations indicate that investigators should assume that all mail items in the synced folder are copied locally and have been compromised.
Microsoft 365: Identifying Mailbox Access | Aon
“Client=ActiveSync” “Client=POP3\/IMAP4;Protocol=POP3” “Client=POP3\/IMAP4;Protocol=IMAP4”
Microsoft 365: Identifying Mailbox Access | Aon
For exact match searches, like identifying a compromised IP address or hunting for a suspicious hash value where(hash.sha="..."), Bloom Filters optimize search time by ruling out irrelevant data - enabling the algorithm to skip logs that would not have matches
New IDR Log Search Enhancements | Rapid7 Blog
50105: Your administrator has configured the application {appName} ({appId}) to block users unless they are specifically granted (assigned) access to the application. The signed in user {user} is blocked because they are not a direct member of a group with access, nor had access directly assigned by an administrator. Please contact your administrator to assign access to this application. 65002: Consent between first party application {applicationId} and first-party resource {resourceId} must be configured via preauthorization—applications owned and operated by Microsoft must get approval from …
When MFA isn’t an option: The legacy of ROPC | Red Canary
Astute readers familiar with Azure AD attacks may have also noticed the “foci” field in the token information above. This indicates that the issued Microsoft Teams refresh token can be used to obtain an access token for other applications, effectively widening the scopes available to an adversary without even requesting consent.
When MFA isn’t an option: The legacy of ROPC | Red Canary
One application they might target to validate the credentials and gain access is Microsoft Teams (Application ID: 1fec8e78-bce4-4aaf-ab1b-5451cc387264), which supports the ROPC flow. With only a single web request, they can validate the credentials and obtain an access token with which they could gain access to the victim resources.
When MFA isn’t an option: The legacy of ROPC | Red Canary
Client=Hub Transport;User=test@some_tenant.onmicrosoft.com;IsClientSubmission=True
Legacy authentication: The curious case of BAV2ROPC
authenticationProtocol is ROPC, and the clientAppUsed used is Authenticated SMTP.
Legacy authentication: The curious case of BAV2ROPC
With BAV2ROPC, you can (sort of) enforce MFA in that authentication can be blocked for protocols that don’t support MFA when MFA is enabled on a user principal.
Legacy authentication: The curious case of BAV2ROPC
We have confirmed through testing that this user agent is set by Microsoft when it identifies basic/legacy authentication from legacy protocols like SMTP AUTH.
Legacy authentication: The curious case of BAV2ROPC
Resource Owner Password Credential (ROPC) that allows a client to accept and transmit valid credentials and pass them on to the IdP for token grants,
Legacy authentication: The curious case of BAV2ROPC
basic authentication is an outdated industry standard that allows applications to send usernames and passwords with every authentication request, making it easier for attackers to capture and abuse user credentials
Legacy authentication: The curious case of BAV2ROPC
SMTP AUTH will remain supported because devices that don’t support modern authentication—like scanners and printers—continue to rely on it
Legacy authentication: The curious case of BAV2ROPC
However, it 12 hours later flagged the session with an offline detection due to an anomalous token detection, which according to Microsoft indicated:
Responding to Adversary in the Middle attacks
That time the whole trading system had to be paused for weeks because of a devilish bug: a low-level optimization routine kept flipping between two equally valid solutions (it was a ‘slightly’ under-determined system) — we eventually figured out it was due to an unstable interaction between our annealing algorithm, our random number generator, and the way eigenvalues work.
Ahead of the (Yield) Curve - by Abraham Thomas - Pivotal
Then, for any market move in between our 60-minute resets, we’d just do a linear approximation — a simple matrix multiplication sufficed to generate the new parameter values, and another one sufficed to generate the predicted yields elsewhere on the curve
Ahead of the (Yield) Curve - by Abraham Thomas - Pivotal
and use them to solve for the 4 daily-changing parameters (4 equations, 4 unknowns). The model would then be able to predict yields at every other point; we could then buy (sell) bonds that appeared cheap (rich) relative to their predicted yields. (Taking into account coupon effects, cashflow timing, financing costs, liquidity and other niggly details of course.)
Ahead of the (Yield) Curve - by Abraham Thomas - Pivotal
8 of the parameters were constants, denoting unchanging structural aspects of the economy; we'd calibrate these about once a year, running an optimization (the EM algorithm) that took many hours to run, over a decade-plus of historical data
Ahead of the (Yield) Curve - by Abraham Thomas - Pivotal
we needed to construct a universe of ‘virtual’ bonds with constant maturities, that were linear combinations of actual bonds.
Ahead of the (Yield) Curve - by Abraham Thomas - Pivotal
OCR tech wasn't great in those days, so we had two separate back offices, in Tokyo and Hong Kong, manually entering prices from these runs.
Ahead of the (Yield) Curve - by Abraham Thomas - Pivotal
Realize that a rough hedge done instantly is superior to a perfect hedge that takes time or costs money.
Ahead of the (Yield) Curve - by Abraham Thomas - Pivotal
LTCM and Simplex both specialized in ‘convergence trading’ — building quantitative models of relationships between different securities; placing bets to exploit inconsistencies (‘mispricings’) in those relationships; and profiting when those inconsistencies resolved (‘converged’).
Ahead of the (Yield) Curve - by Abraham Thomas - Pivotal
The threat actors misused the OAuth applications with high privilege permissions to deploy virtual machines (VMs) for cryptocurrency mining, establish persistence following business email compromise (BEC), and launch spamming activity using the targeted organization’s resources and domain name.
Threat actors misuse OAuth applications to automate financially driven attacks | Microsoft Security Blog
These logins were carried out from the same VPN endpoints as the attacker’s original logins. On February 11, the attacker was observed creating an inbox rule named “ , ” on one of these accounts. Shortly after, the attacker went on to register and grant permissions to the same mass-mailing application,
Email Compromise To Mass Phishing Campaign | Darktrace Blog
you’ll see that you can link the site to a 365 account via an app consent, grant it permission to view your contacts
Common Oauth Apps Used in Business Email Compromise – Syne's Cyber Corner
Thankfully, usage of this application has dropped significantly, as it now appears to require administrator consent to be used.
Common Oauth Apps Used in Business Email Compromise – Syne's Cyber Corner
The only problem that I can see, is that the only actions I find in the UAL are the Bind type, while I would expect them to instead be the Sync type.
Malicious Usage of eM Client In Business Email Compromise – Syne's Cyber Corner
As I mentioned earlier, eM Client’s use of EWS means that it has many features and settings that are interesting and potentially useful during a BEC.
Malicious Usage of eM Client In Business Email Compromise – Syne's Cyber Corner
Since multiple accounts for multiple email providers can be added, this application would allow threat actors to easily switch between many compromised accounts without having to sign in/out.
Malicious Usage of eM Client In Business Email Compromise – Syne's Cyber Corner
The exact permissions granted to the applications are your standard permissions for most integrated oauth applications, with the addition of EWS.AccessAsUser.All.
Malicious Usage of eM Client In Business Email Compromise – Syne's Cyber Corner
For M365, this means opening a browser and using the modern authentication login. After logging in, you are presented with a request to accept the application’s permissions.
Malicious Usage of eM Client In Business Email Compromise – Syne's Cyber Corner
For M365, this means opening a browser and using the modern authentication login. After logging in, you are presented with a request to accept the application’s permissions.
Malicious Usage of eM Client In Business Email Compromise – Syne's Cyber Corner
It connects using Exchange Web Services, which is an API that allows non-Microsoft applications to integrate with Exchange Online and On-Premise Exchange.
Malicious Usage of eM Client In Business Email Compromise – Syne's Cyber Corner
My testing has shown me that this tool cannot be used to back up mailboxes that the user has delegated access to
Malicious Azure Application PERFECTDATA SOFTWARE and Microsoft 365 Business Email Compromise – Syne's Cyber Corner
Now, remember what I said about administrative users? Well, this tool will allow an administrative account to back up as many mailboxes as a person wants.
Malicious Azure Application PERFECTDATA SOFTWARE and Microsoft 365 Business Email Compromise – Syne's Cyber Corner
Since it’s a PST, it grabs calendar events and contacts on top of emails and attachments.
Malicious Azure Application PERFECTDATA SOFTWARE and Microsoft 365 Business Email Compromise – Syne's Cyber Corner
This application is used to take a backup of the entire mailbox from the cloud and export it to PST. Assume that everything within the mailbox is lost, and any useful information will be used for future fraud or sold on the dark net. Oh, and if it was an administrative user compromised? It could potentially be every mailbox within the organization.
Malicious Azure Application PERFECTDATA SOFTWARE and Microsoft 365 Business Email Compromise – Syne's Cyber Corner
With secrets and other configuration decoupled from the Kubernetes cluster or VMs that run the services, we can easily reapply them onto new infrastructure should an incident ever pop up, making it simple to isolate and replace nodes of a service.
How Palantir Meets IL6 Security Requirements with Apollo | by Palantir | Palantir Blog
Instead, brands carve out a relatively narrow slice of brand-identity space and occupy it for decades. And the cultural imprinting model explains why. Brands need to be relatively stable and put on a consistent "face" because they're used by consumers to send social messages, and if the brand makes too many different associations, (1) it dilutes the message that any one person might want to send, and (2) it makes people uncomfortable about associating themselves with a brand that jumps all over the place, firing different brand messages like a loose cannon.
Ads Don't Work That Way
The answer, I think, is that going to a gas station is a personal rather than a social activity, whereas drinking a soda is so often done in the company of others.
Ads Don't Work That Way
Because during the Superbowl, everyone knows that everyone else is watching, and so any brand image that's conveyed during the Superbowl is almost guaranteed to take root in the broader culture, and therefore to be perceived "correctly" at a later date.
Ads Don't Work That Way
Peer pressure is an extremely powerful force, and if advertising can tap into it even a fraction of that power, it can have a sizable effect.
Ads Don't Work That Way
Over time and with enough exposure, the customer will realize that "Nike" is synonymous with "athletic excellence" out in the broader culture.
Ads Don't Work That Way
in other words, in broadcast media
Ads Don't Work That Way
I have to see the ad, but I also have to know (or suspect) that most of my friends have seen the ad too
Ads Don't Work That Way