Full Report
Can we use anomalous user agents to detect potential business email compromise (BEC) in Microsoft 365? Explore what we found through threat hunting for BEC.
Analysis Summary
# Best Practices: Detecting BEC via Anomalous User Agents
## Overview
These practices address the detection of **Business Email Compromise (BEC)** by monitoring Microsoft 365 (M365) authentication telemetry. The focus is on identifying "anomalous user agents"—specifically those belonging to command-line tools or developer SDKs (like Azure CLI or Python)—which are frequently used by attackers to bypass standard web interfaces and automate data exfiltration or account manipulation.
## Key Recommendations
### Immediate Actions
1. **Enable Verbose Logging:** Ensure Microsoft 365 Unified Audit Logs (UAL) and Azure AD (Entra ID) Sign-in logs are enabled and being ingested into a searchable security platform (SIEM/Log Management).
2. **Audit Successful Logins:** Filter sign-in logs specifically for "Success" events originating from non-browser user agents (e.g., `curl`, `python-requests`, `AzureCLI`).
3. **Alert on Known Offensive User Agents:** Create alerts for common default strings used in automated tools, such as `AZURECLI/` or `azsdk-python`.
### Short-term Improvements (1-3 months)
1. **Establish a User Agent Baseline:** Identify the "Normal" for your environment. Determine if any legitimate admins or automated services are authorized to use command-line tools for M365 management.
2. **Implement Conditional Access (CA) Policies:** Restrict access to M365 management interfaces (like Azure Management) to known IP ranges or compliant devices only.
3. **Enforce Phishing-Resistant MFA:** While attackers can bypass some MFA, enforcing FIDO2 or certificate-based authentication significantly raises the bar for BEC scripts.
### Long-term Strategy (3+ months)
1. **Identity Threat Detection and Response (ITDR):** Move toward a continuous monitoring model that correlates user agent anomalies with other signals like "Impossible Travel" or "New Country" logins.
2. **Automated Response Playbooks:** Develop automated workflows to disable accounts or revoke sessions when a high-confidence anomalous user agent (like a generic Python script) successfully authenticates from an unverified IP.
## Implementation Guidance
### For Small Organizations
- **Focus:** Manual review of M365 Sign-in logs.
- **Action:** Check the "User Agent" column in the Entra ID Sign-in logs once a week for anything that isn't a standard browser (Chrome, Edge, Safari) or mobile app.
### For Medium Organizations
- **Focus:** Alerting and Log Aggregation.
- **Action:** Use a tool like Microsoft Sentinel or a managed SOC provider to automatically flag successful logins where the User Agent contains `Python`, `PowerShell`, or `CLI`.
### For Large Enterprises
- **Focus:** Behavioral Analytics.
- **Action:** Implement advanced anomaly detection that flags a user agent change *relative to that specific user's history*. If a Finance user suddenly logs in via `curl`, trigger an immediate high-severity incident.
## Configuration Examples
### KQL Query for Threat Hunting (Microsoft Sentinel/Log Analytics)
kusto
SigninLogs
| where ResultType == 0 // Successful Logins
| extend UserAgent = tostring(DeviceDetail.browser)
| where UserAgent has_any ("python", "curl", "Wget", "AzureCLI", "azsdk-python")
| project TimeGenerated, UserPrincipalName, IPAddress, UserAgent, Location
## Compliance Alignment
- **NIST SP 800-53:** Control AC-2 (Account Management) and AU-6 (Audit Review, Analysis, and Reporting).
- **CIS Control 5.2:** Maintain an Inventory of Assets and Software (monitoring what "software" is accessing the environment).
- **ISO/IEC 27001:** Annex A.12.4 (Logging and Monitoring).
## Common Pitfalls to Avoid
- **Ignoring "Success":** Do not only look for failed logins. Attackers using these tools often already have valid credentials or session tokens; the "Success" with a weird tool is the primary indicator.
- **Over-Reliance on User Agent Strings:** Remember that sophisticated attackers *can* spoof user agents. Treat an anomalous agent as a high-fidelity signal, but don't assume a standard browser string is always safe.
- **Alert Fatigue:** Avoid alerting on every non-standard agent if you have developers who legitimately use Azure CLI. Whitelist their specific IP addresses or service accounts.
## Resources
- **Microsoft Entra ID Sign-in Logs Documentation:** [https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-sign-ins](https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-sign-ins)
- **AADInternals (Offensive Tool Research):** [https://github.com/Gerenios/AADInternals](https://github.com/Gerenios/AADInternals) (Use for understanding attacker methodology).
- **Huntress Threat Hunting Blog:** [https://www.huntress.com/blog](https://www.huntress.com/blog)