Threat video1:00
Microsoft Teams Booking-Flow Phishing: Detection & IOCs
Fake Teams booking pages hand attackers a device code on Microsoft's real login page: 9 detection rules, 9 IOCs and a free Splunk SPL rule.
Read the full threat intel for Microsoft Teams Booking-Flow Phishing: Detection & IOCs →
Chapters
- 0:00The hookFake Teams booking, real Microsoft login.
- 0:04The storyA typosquatted domain sent the lure.
- 0:11Attack pathA lookalike domain sent a fake booking.
- 0:26AttributionNo threat actor is attributed.
- 0:31Indicators of compromise5 indicators to hunt: 1 domain, 2 URLs and 2 paths.
- 0:37MITRE ATT&CK techniques12 ATT&CK techniques, from resource development to command and control.
- 0:42Remediation4 steps now: Revoke refresh tokens and sign-in sessions for any account.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Fake Teams booking, real Microsoft login.
0:05A typosquatted domain sent the lure.
0:07The victim pasted the code.
0:11A lookalike domain sent a fake booking.
0:14Google redirects led to the scheduler.
0:16The page showed a device code.
0:18A residential proxy completed the login.
0:21Then the session was replayed.
0:26No threat actor is attributed. Confidence: low.
0:315 indicators to hunt: 1 domain, 2 URLs and 2 paths.
0:3712 ATT&CK techniques, from resource development to command and control.
0:434 steps now: Revoke refresh tokens and sign-in sessions for any account.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.