Full Report
There’s never just one termite. Huntress has spent the last 6 months researching and cracking down on malicious OAuth applications. Read about what we’ve found in this blog!
Analysis Summary
# Tool/Technique: Malicious OAuth Applications (Rogue Apps)
## Overview
This technique involves the creation or compromise of OAuth applications within Microsoft 365/Azure environments to maintain persistent access to tenant data without the need for a user's password or ongoing session. Attackers trick users into granting permissions (consent phishing) or use compromised administrative credentials to register these applications, effectively creating a "backdoor" into the organization's cloud infrastructure.
## Technical Details
- **Type**: Technique / Persistence Mechanism
- **Platform**: Microsoft 365, Azure Active Directory (Entra ID)
- **Capabilities**: Persistent data access, bypassing MFA, mail exfiltration, automated internal phishing, and tenant reconnaissance.
- **First Seen**: Ongoing; Huntress research highlights a significant surge in the six months leading up to February 2025.
## MITRE ATT&CK Mapping
- **[TA0003 - Persistence]**
- [T1136.003 - Create Account: Cloud Account]
- [T1098.003 - Account Manipulation: Additional Cloud Credentials]
- **[TA0001 - Initial Access]**
- [T1566.002 - Phishing: Spearphishing Link (Consent Phishing)]
- **[TA0006 - Credential Access]**
- [T1528 - Steal Application Access Token]
## Functionality
### Core Capabilities
- **Token-Based Persistence**: Once consent is granted, the attacker receives an access token and a refresh token. The refresh token allows the attacker to generate new access tokens indefinitely (until revoked), bypassing Multi-Factor Authentication (MFA) and password changes.
- **Data Exfiltration**: Permissions like `Mail.Read`, `Notes.Read.All`, or `Files.Read.All` allow automated harvesting of sensitive communications and documents.
- **API Interaction**: Uses Microsoft Graph API to interact with the tenant programmatically rather than through a GUI.
### Advanced Features
- **Evasion via Naming**: Applications are often named to blend in with legitimate tenant activity (e.g., named after the tenant domain, "Test App," or specific user names).
- **Loopback Redirection**: Use of specific local loopback URLs for capturing authorization codes during the OAuth flow.
- **Automation**: Ability to use the compromised app to send internal phishing emails to other employees, leveraging the trust of an internal sender.
## Indicators of Compromise
- **File Names**: N/A (Cloud-native; look for Application Display Names)
- Apps named after a specific user account.
- Apps named “Test”, “Test App”, or similar.
- Apps named after the tenant domain name.
- Apps with non-alphanumeric names (e.g., "........").
- **Network Indicators**:
- `http://localhost:7823/access/` (Commonly used reply URL in malicious registrations).
- **Behavioral Indicators**:
- Sudden registration of a new "Enterprise Application" by a non-admin user.
- Applications granted high-privilege permissions (e.g., `AppRoleAssignment.ReadWrite.All`) without a clear business case.
- Logins originating from data center IP ranges (AS-based anomalies) rather than residential/corporate ISPs.
## Associated Threat Actors
- While specific group names were not the focus of this report, these techniques are widely used by **Financial Motivated Actors (BEC)** and **State-Sponsored Actors (APT)** for long-term espionage.
## Detection Methods
- **Behavioral Detection**: Monitoring for "consent-to-app" events involving sensitive permissions.
- **Tooling**: Use of open-source scripts like **Cazadora** (developed by Matt Kiely/HuskyHacks) to audit tenant applications.
- **Audit Logs**: Reviewing Azure AD Audit Logs for `Add service principal` and `Consent to application` operations.
## Mitigation Strategies
- **Restrict User Consent**: Configure Microsoft 365 to only allow users to consent to apps from "verified publishers" or require admin workflow approval for all apps.
- **Least Privilege**: Audit and prune existing Enterprise Applications; remove any with high-privilege scopes that are no longer required.
- **Conditional Access**: Implement policies that restrict access to cloud apps based on device compliance or trusted locations.
- **Regular Audits**: Periodically review "Application Registrations" and "Enterprise Applications" for anomalous names or redirect URIs.
## Related Tools/Techniques
- **Adversary-in-the-Middle (AiTM)**: Often used to harvest the initial credentials needed to register a rogue app.
- **Cazadora**: An open-source auditing tool specifically designed to find these "termite" apps.
- **Microsoft Graph API Exploitation**: The underlying mechanism for interacting with the tenant post-infection.