Threat video1:00
Whitsett, NC Microsoft 365 Hijack: Detection & IOCs
A hijacked Whitsett town hall Microsoft 365 account sent a fake payment report: 9 detection rules, 5 IOCs and a free Splunk SPL rule.
Read the full threat intel for Whitsett, NC Microsoft 365 Hijack: Detection & IOCs →
Chapters
- 0:00The hookTown hall account compromised for phishing.
- 0:05The storyTown account sent fake payment email.
- 0:11Attack pathThe account was compromised.
- 0:25AttributionNo threat actor is attributed.
- 0:30Indicators of compromiseNo malicious indicators were published.
- 0:37MITRE ATT&CK techniques5 ATT&CK techniques, from resource development to stealth.
- 0:42Remediation4 steps now: Disable the compromised account or reset its password and revoke.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Town hall account compromised for phishing.
0:05Town account sent fake payment email.
0:07From real account, it passed all checks.
0:12The account was compromised.
0:14Impersonated the town administrator.
0:16Sent fake payment email with attachments and password.
0:26No threat actor is attributed. Confidence: low.
0:31No malicious indicators were published.
0:375 ATT&CK techniques, from resource development to stealth.
0:424 steps now: Disable the compromised account or reset its password and revoke.
0:509 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.