sublimehighRule

Attachment: Suspicious Office 365 app authorization (OAuth) link

Detects inbound messages whose PDF, HTML, DOCX, or PPTX attachments contain a suspicious Office 365 app authorization (OAuth) link. The app may be compromised or was stood up for malicious purposes. Once the app has been authorized, the attacker will have read or write permissions to the user's Office 365 account. ICS and EML attachments are covered by separate rules.

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598

Detection Query

type.inbound
and any(filter(attachments, .file_type in ("pdf", "html", "docx", "pptx")),
        any(file.explode(.),
            any(.scan.url.urls,
                (
                  .domain.domain in (
                    'login.microsoftonline.com',
                    'login.microsoft.com'
                  )
                  or strings.icontains(.query_params,
                                       "login.microsoftonline.com",
                                       'login.microsoft.com'
                  )
                )
                and (
                  strings.ilike(.query_params,
                                '*offline_access*',
                                '*.readwrite*',
                                '*.read*',
                                '*ctx=*',
                                '*prompt=none*'
                  )
                  or (
                    strings.icontains(.path, '/common/reprocess')
                    and strings.icontains(.query_params, 'ctx=')
                    and strings.icontains(.query_params, 'sessionId=')
                  )
                )
            )
        )
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

References

https://info.phishlabs.com/blog/office-365-phishing-uses-malicious-app-persist-password-reset

Raw Content

name: "Attachment: Suspicious Office 365 app authorization (OAuth) link"
description: "Detects inbound messages whose PDF, HTML, DOCX, or PPTX attachments contain a suspicious Office 365 app authorization (OAuth) link. The app may be compromised or was stood up for malicious purposes. Once the app has been authorized, the attacker will have read or write permissions to the user's Office 365 account. ICS and EML attachments are covered by separate rules."
references:
  - "https://info.phishlabs.com/blog/office-365-phishing-uses-malicious-app-persist-password-reset"
type: "rule"
severity: "high"
source: |
  type.inbound
  and any(filter(attachments, .file_type in ("pdf", "html", "docx", "pptx")),
          any(file.explode(.),
              any(.scan.url.urls,
                  (
                    .domain.domain in (
                      'login.microsoftonline.com',
                      'login.microsoft.com'
                    )
                    or strings.icontains(.query_params,
                                         "login.microsoftonline.com",
                                         'login.microsoft.com'
                    )
                  )
                  and (
                    strings.ilike(.query_params,
                                  '*offline_access*',
                                  '*.readwrite*',
                                  '*.read*',
                                  '*ctx=*',
                                  '*prompt=none*'
                    )
                    or (
                      strings.icontains(.path, '/common/reprocess')
                      and strings.icontains(.query_params, 'ctx=')
                      and strings.icontains(.query_params, 'sessionId=')
                    )
                  )
              )
          )
  )
attack_types:
  - "Credential Phishing"
detection_methods:
  - "URL analysis"
related_detections:
  - "link_office365_suspicious_app_authorization.yml"
  - "attachment_ics_link_office365_suspicious_app_authorization.yml"
  - "attachment_eml_link_office365_suspicious_app_authorization.yml"
  - "link_self_service_platform_link_to_microsoft_redirect.yml"
id: "b25398fa-42c6-5add-a9ee-f1f1ed586447"