Threat video1:00
Microsoft 365 RejectDirectSend Bypass: Detection & IOCs
A blank SMTP envelope sender lets phishing skip RejectDirectSend and reach executives. 9 detection rules, 2 IOCs and a free Splunk SPL rule.
Read the full threat intel for Microsoft 365 RejectDirectSend Bypass: Detection & IOCs →
Chapters
- 0:00The hookPhishing bypassed Microsoft's control with blank sender fields.
- 0:04The storyIt targeted executives and finance teams.
- 0:11Attack pathAttackers sent blank envelope senders with forged From headers.
- 0:29AttributionNo threat actor is attributed.
- 0:33Indicators of compromiseNo malicious indicators were published.
- 0:39MITRE ATT&CK techniques7 ATT&CK techniques, from initial access to stealth.
- 0:43Remediation4 steps now: Hunt for messages with an empty envelope sender.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Phishing bypassed Microsoft's control with blank sender fields.
0:05It targeted executives and finance teams.
0:07Payment and SVG lures were used.
0:11Attackers sent blank envelope senders with forged From headers.
0:15Empty sender bypassed the control check; messages were accepted.
0:19Those matching overrides reached inboxes and delivered SVG lures.
0:24Victims followed links and opened attachments.
0:29No threat actor is attributed. Confidence: low.
0:34No malicious indicators were published.
0:397 ATT&CK techniques, from initial access to stealth.
0:444 steps now: Hunt for messages with an empty envelope sender.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.