Threat video1:00
Microsoft Teams Device Code Phishing: Detection & IOCs
A fake Teams booking page tricks construction staff into approving a device code sign-in. 9 detection rules, 13 IOCs and a free Splunk SPL rule.
Read the full threat intel for Microsoft Teams Device Code Phishing: Detection & IOCs →
Chapters
- 0:00The hookFake Teams invite yielded a session token.
- 0:04The storyIt impersonated a senior vice president.
- 0:11Attack pathTrusted redirects hid a fake scheduler.
- 0:26AttributionNo threat actor is attributed.
- 0:31Indicators of compromise8 indicators to hunt: 1 domain, 5 paths and 2 hostings.
- 0:37MITRE ATT&CK techniques13 ATT&CK techniques, from resource development to command and control.
- 0:43Remediation4 steps now: Block or sinkhole gpimmlgration[.]com and the observed lure paths.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Fake Teams invite yielded a session token.
0:05It impersonated a senior vice president.
0:07One employee approved the sign-in.
0:11Trusted redirects hid a fake scheduler.
0:14The victim got a genuine device code.
0:16The victim pasted it at devicelogin.
0:19The attacker got a valid session token. Huntress contained it.
0:26No threat actor is attributed. Confidence: low.
0:318 indicators to hunt: 1 domain, 5 paths and 2 hostings.
0:3713 ATT&CK techniques, from resource development to command and control.
0:434 steps now: Block or sinkhole gpimmlgration[.]com and the observed lure paths.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.