‎Investigate unusual use patterns for

‎accounts

‎https://compliance.microsoft.com ‎Use Unified Access Logging Data

‎Not available for all access levels

‎Less-featured licenses offer fewer

‎Handles may different authentication
‎monitoring capabilities
‎Watch for Unauthorized Account ‎Cloud SaaS Endpoint ‎functions for Microsoft 365
‎License Downgrades
‎Look for accounts of E5, E3 level being ‎Publicly Accessible
‎demoted to P1, SBP
‎ icrosoft 365 Incident
M
‎Response: Identification ‎Status code reveals details
‎Unauthorized Conditional Access policy ‎about targeted user
‎changes

‎Look for MFA Access Changes ‎Invalid credentials

‎New geographic, IP address MFA
‎exceptions
‎login.microsoft.com ‎MFA (Microsoft) required
‎Returns Detailed Errors
‎ et-Mailbox -Identity donovan.lea@
G
‎falsimentis.com | Format-List *audit* ‎MFA (third-party) required

‎Investigate Accounts with Disabled ‎Account disabled

‎-AuditEnabled=$false
‎Auditing

‎-AuditOwner @() ‎Account locked out

‎Search logs for Set-Mailbox commands
‎with arguments:
‎Attacker Opportunity for Password
‎-AuditDelegate @()
‎Attacks

‎-AuditAdmin @()

‎Attack/Defense Tool ‎Leverages login.microsoft.com for

‎Password Spray
‎Requires valid credentials!
‎Checks Multiple Microsoft Login
‎MSOLSpray ‎Uses Error Codes to Optimize Attack
‎Endpoints
‎Use without valid credentials may trigger
‎account lockout ‎Takes a User List and a Single Password
‎MFASweep
‎Identified Endpoints That Don't Require
‎e.g., Conditional Access exceptions ‎MFA ‎On-by-default Feature for Microsoft 365

‎Offers Brief Recommendations to ‎Attempts to Thwart Many Types of ‎Some advanced capabilities available with
‎Leverage Access ‎Password Attacks ‎more expensive user licenses
‎ ICROSOFT 365
M
‎PASSWORD ATTACKS ‎Account Lockout: Disable Login for
‎Universally applied across accounts ‎Azure Smart Lockout ‎Single Account ‎After multiple failed attempts
‎Basic MFA is Effective
‎Doesn't always meet business needs ‎After 10 login failures regardless of
‎username
‎Permit exceptions to MFA requirements ‎Source Blocking: Don't Allow IP to Login
‎After 3 login failures for Azure .gov
‎Geolocation
‎Smart Lockout Defeats Common Spray
‎IP addresses or ranges of IP addresses ‎MFA Bypass  ‎Attacks ‎... when originating from a single source IP
‎Conditional Access (CA)

‎Specific platforms
‎Amazon AWS Service
‎Legacy systems
‎Maps a single hostname to multiple
‎microservices
‎Looking for opportunities to login ‎Attackers Use Valid Credentials with
‎without MFA ‎MFA
‎HTTP Service for API Connectivity ‎Each worker has a unique IP

‎Uses thousands of HTTP workers

‎Attack Tool to Easily Setup AWS API ‎Worker IPs originate in the AWS IP
‎Gateway ‎AWS API Gateway ‎address space ‎For the target region

‎Specify a Command, Region, and URL ‎Cheap! ‎1 million requests is $1

‎Attacker submits HTTP requests through
‎AWS API Gateway hostname
‎ enerates URL like https://7t4id9w399.
G ‎AWS API GW forwards attacker request
‎execute-api.us-east-1.amazonaws.com/
‎fireprox/
‎Specify FireProx API URL with
‎MSOLSpray -URL parameter
‎FireProx Creates the AWS API Gateway
‎FireProx
‎Endpoint
‎ ttackers can be very crafty in
A
‎Integrates with MSOLSpray
‎how they implement attacks
‎Attacker can proxy requests to target
‎HTTP endpoint
‎ ttackers will use cloud services
A
‎against your organization
‎Attacker Opportunity to Masquerade IP ‎through worker
‎Each request will come from a different
‎source IP address