Threat video1:00
Green Proxy Microsoft 365 AiTM Platform: Detection & IOCs
Green Proxy relays Microsoft 365 sign-ins live and steals sessions past non-phishing-resistant MFA. Get 9 detection rules, 17 IOCs and a free Splunk SPL rule.
Read the full threat intel for Green Proxy Microsoft 365 AiTM Platform: Detection & IOCs →
Chapters
- 0:00The hookGreen Proxy: Microsoft phishing platform.
- 0:04The storySeptember relay compromised mailboxes.
- 0:10Attack pathRelay and compromised mailboxes setup.
- 0:24AttributionNo threat actor is attributed.
- 0:28Indicators of compromise15 indicators to hunt: 3 IPs, 9 domains and 1 URL, and more.
- 0:34MITRE ATT&CK techniques9 ATT&CK techniques, from resource development to lateral movement.
- 0:39Remediation6 steps now: Block greenproxysimpleserver[.]cc, yizhaojingyun[.]com, eargentyna[.]com, ipfs-us[.]com, murrezbots[.]vip and IPs.
- 0:51Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Green Proxy: Microsoft phishing platform.
0:05September relay compromised mailboxes.
0:07OAuth lure captures sessions.
0:10Relay and compromised mailboxes setup.
0:13Minimal emails, OAuth lure.
0:15Gate masks from analysis.
0:17Intercepts real Microsoft sign-in.
0:20Stolen sessions bypass MFA.
0:24No threat actor is attributed. Confidence: low.
0:2815 indicators to hunt: 3 IPs, 9 domains and 1 URL, and more.
0:359 ATT&CK techniques, from resource development to lateral movement.
0:406 steps now: Block greenproxysimpleserver[.]cc, yizhaojingyun[.]com, eargentyna[.]com, ipfs-us[.]com, murrezbots[.]vip and IPs.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.