Listen to this Post
Introduction:
A new wave of phishing campaigns is strategically bypassing enterprise defenses by hosting malicious links within trusted Microsoft services like Power BI, Forms, and Azure Storage. This technique exploits the inherent trust organizations place in Microsoft’s ecosystem, allowing attackers to evade traditional URL filters and domain blocklists. Security teams must now extend their zero-trust principles to include these foundational platforms to prevent credential theft and malware deployment.
Learning Objectives:
- Understand the mechanics of how Microsoft services are being abused for phishing.
- Learn to deploy detection rules using KQL and PowerShell to identify malicious activity.
- Implement hardening measures for Microsoft 365, Azure, and endpoints to mitigate these threats.
You Should Know:
1. Detecting Power BI Phishing with KQL
`EmailUrlInfo
| where Url has “app.powerbi.com/view”
| join kind=inner (
EmailEvents
| where EmailDirection == “Inbound”
| where SenderFromAddress !contains “@microsoft.com”
) on NetworkMessageId
| project Timestamp, SenderFromAddress, RecipientEmailAddress, Url, Subject`
This Kusto Query Language (KQL) query, designed for Microsoft Defender for Office 365, identifies emails containing Power BI report viewer links. The query first filters the `EmailUrlInfo` table for URLs containing the Power BI viewer path, then performs an inner join with inbound `EmailEvents` to enrich the data with email specifics. Crucially, it excludes emails from official Microsoft addresses to reduce false positives. Run this query in the Microsoft 365 Defender Advanced Hunting console to proactively hunt for campaigns abusing this vector.
2. Blocking OneNote Malware with ASR Rules
`Set-MpPreference -AttackSurfaceReductionRules_Ids 92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B -AttackSurfaceReductionRules_Actions Enabled`
This PowerShell command, executed in an administrative session, enables an Attack Surface Reduction (ASR) rule to block Office applications from creating executable content. This directly counters the mentioned OneNote attack vector where a document, once opened, downloads and executes a payload. The rule ID `92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B` corresponds to the “Block all Office applications from creating child processes” rule. Deploy this configuration via Intune or Group Policy to protect endpoints.
3. Auditing Suspicious Azure Storage Accounts
`Get-AzStorageAccount | Get-AzStorageContainer | Where-Object {$_.PublicAccess -ne “Off”} | Select-Object -Property @{Name=”StorageAccount”; Expression={$_.StorageAccountName}}, @{Name=”Container”; Expression={$_.Name}}, PublicAccess`
This Azure PowerShell module command audits all storage accounts in a subscription for containers with public anonymous read access. Attackers often leverage such misconfigured containers on `.blob.core.windows.net` to host phishing kits. The cmdlet `Get-AzStorageAccount` retrieves all storage accounts, which are piped to `Get-AzStorageContainer` to list their containers. The results are filtered for any container where the `PublicAccess` property is not ‘Off’. Regularly run this audit and enforce policies to require private access by default.
4. Inspecting Microsoft Forms for Phishing Lures
`Get-MgUser -All | ForEach-Object { Get-MgUserOwnedObject -UserId $_.Id -ConsistencyLevel eventual }`
While there is no direct command to scan all Forms, this Microsoft Graph PowerShell command can help identify resources, including potential Forms, owned by users. A more practical step is to navigate manually to `forms.office.com` and review the “Shared with me” section for any unexpected or suspicious forms. Forms used in phishing often have generic titles like “Document Review” or “Password Verification.” Combine this with user training to report unsolicited forms.
5. Enforcing Conditional Access for Session Token Protection
`New-ConditionalAccessPolicy -DisplayName “Require Compliant Device for M365 Apps” -State “on” -Conditions @{ Applications = @{ IncludeApplications = “Office365” }; ClientAppTypes = “all”; Locations = @{ IncludeLocations = “All” }; Users = @{ IncludeUsers = “All” } } -GrantControls @{ Operator = “OR”; BuiltInControls = “requireCompliantDevice” }`
This PowerShell command for the AzureAD or Microsoft Graph module creates a Conditional Access policy. This policy mitigates session token theft, as mentioned in the OneDrive attack, by ensuring that access to Office 365 applications is only granted from Intune-compliant and hybrid Azure AD joined devices. Even if a token is stolen, an attacker from an unmanaged device will be blocked. Configure such policies in the Azure AD portal under Security > Conditional Access.
6. Disabling Automatic Forwarding via Mail Flow Rules
`New-TransportRule -Name “Block External Auto-Forwarding” -SentToScope “NotInOrganization” -MessageTypeMatches “AutoForward” -RejectMessageReasonText “Automatic forwarding to external addresses is prohibited.”`
This Exchange Online PowerShell command creates a mail flow rule to block emails that are automatically forwarded to external addresses. This is a critical control to disrupt the propagation phase of the OneNote attack, where the malware attempts to share infected files from a victim’s OneDrive to all contacts. The rule uses the `-MessageTypeMatches “AutoForward”` parameter to identify and block such messages, preventing mass phishing from compromised accounts.
7. Hardening TLS Inspection Policies
`Add-DnsServerClientSubnet -Name “CorporateNetwork” -IPv4Subnet “192.168.1.0/24″`
This Windows Server DNS command illustrates the foundational step of defining your corporate subnets. The key takeaway from the comments is to never bypass TLS inspection for major domains like `.microsoft.com` or .windows.net. In your secure web gateway or firewall, ensure that all outbound traffic, including that destined for Microsoft URLs, is subject to SSL/TLS decryption and inspection. This allows your security stack to analyze the true content of connections to Power BI and other services, catching the malicious redirects that would otherwise be hidden by encryption.
What Undercode Say:
- Trust No Domain, Especially Microsoft’s. The core lesson is that a zero-trust architecture is meaningless if you implicitly allowlist massive domains like Microsoft’s. TLS inspection must be universally applied.
- Detection is Your Last Line of Defense. When prevention fails, as it will with abused trusted services, your ability to detect anomalous activity within those services—using KQL, audit logs, and behavioral analytics—becomes paramount.
The shift by attackers to abuse Microsoft’s core productivity and analytics platforms represents a sophisticated evolution in phishing. It’s a force multiplier; they are effectively using an organization’s own security policies against it. The common practice of allowing these domains through filters without inspection, often for compatibility reasons, has created a massive blind spot. This isn’t a vulnerability in Microsoft’s code, but a strategic exploitation of trust configurations. The analysis in the comments unanimously points to a failure in implementing zero-trust principles comprehensively. The future of this attack vector will likely expand to include other SaaS platforms like Google Workspace and Salesforce, making cross-platform threat hunting and consistent policy enforcement the new baseline for defense.
Prediction:
This abuse of trusted SaaS platforms will rapidly evolve beyond simple phishing to become a primary method for distributing ransomware and conducting Business Email Compromise (BEC). We will see attackers using these Microsoft-hosted lures to deploy sophisticated malware that leverages stolen session tokens to maintain persistent, authenticated access within a corporate tenant, bypassing MFA and making detection exponentially more difficult. This will force a fundamental re-architecture of cloud security, moving from domain-based allowlisting to a model of continuous, behavior-based verification for every user, device, and application request, regardless of its source IP or domain.
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Wjpvandenheuvel Phishing – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
