Full Report
A recent trend has emerged where threat actor groups (e.g., ShinyHunters, PEAR, HELIX, etc.) have been leveraging phishing and vishing techniques to gain access to M365 email accounts. Through identity and token abuse, these actors have then automated large-scale file exfiltration and extortion campaigns targeting SharePoint, OneDrive, Microsoft Entra ID (formerly Azure AD), and email data through abuse of the Microsoft Graph API.
Analysis Summary
# Tool/Technique: M365 API-Based Automated Exfiltration
## Overview
This technique involves the abuse of identity tokens and the Microsoft Graph API to automate the large-scale exfiltration of data from Microsoft 365 environments. Threat actors leverage this method to bypass traditional "FileDownloaded" logging, as programmatic retrieval of file content via APIs often results in "FileAccessed" telemetry in the Unified Audit Log (UAL), leading to potential underestimation of data exposure during forensic investigations.
## Technical Details
- **Type:** Technique / Attack Framework
- **Platform:** Microsoft 365 (SharePoint, OneDrive, Entra ID, Exchange), SSO-connected platforms (Salesforce, Jira)
- **Capabilities:** Automated file enumeration, mass data exfiltration, token abuse, and bypassing standard download indicators.
- **First Seen:** Reported as a recent trend (documented September 2024).
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- T1566.001 - Phishing: Spearphishing Attachment
- T1566.003 - Phishing: Voice (Vishing)
- **TA0004 - Privilege Escalation**
- T1550.004 - Use Alternate Authentication Material: Web Session Cookie / Access Tokens
- **TA0007 - Discovery**
- T1083 - File and Directory Discovery
- **TA0010 - Exfiltration**
- T1020 - Automated Exfiltration
- T1567 - Exfiltration Over Web Service
## Functionality
### Core Capabilities
- **Identity & Token Abuse:** Leveraging compromised credentials and session tokens to maintain access without triggering MFA.
- **Microsoft Graph API Exploitation:** Using the API to programmatically browse and retrieve content from SharePoint and OneDrive.
- **SSO Pivot:** Using Microsoft 365 as a gateway to access and exfiltrate data from connected third-party SaaS applications (Jira, Salesforce).
### Advanced Features
- **Logging Evasion:** Executing file acquisition in a manner that triggers "FileAccessed" or "FilePreviewed" events instead of the more high-alert "FileDownloaded" event.
- **Automated Rapid Exfiltration:** Utilizing Python or PowerShell scripts to retrieve hundreds of files in seconds, far exceeding human interactive speeds.
## Indicators of Compromise
- **File Hashes:** N/A (Script-based/API-based activity).
- **File Names:** N/A.
- **Registry Keys:** N/A.
- **Network Indicators:**
- Access originating from suspicious source IP addresses or known proxy/VPN infrastructure.
- Unusual User-Agent strings (e.g., `python-requests`, `PowerShell`, or non-browser API clients).
- **Behavioral Indicators:**
- Rapid sequential "FileAccessed" events within seconds/minutes.
- Large-scale file enumeration or search activity preceding access.
- Usage of the "My Apps" page to pivot into connected enterprise applications.
## Associated Threat Actors
- **ShinyHunters**
- **PEAR**
- **HELIX**
## Detection Methods
- **Signature-based detection:** Monitoring for known malicious User-Agents associated with automated exfiltration scripts.
- **Behavioral detection:**
- Monitoring M365 UAL for high volumes of `FileAccessed` events from a single identity within a short window.
- Alerting on Graph API calls originating from non-standard or unauthorized IP ranges.
- Correlating `FileAccessed` events with scripted User-Agents (Python, PowerShell).
## Mitigation Strategies
- **Prevention measures:**
- Implement Conditional Access Policies to restrict API access to managed devices or known locations.
- Enforce Phishing-resistant MFA (FIDO2) to prevent initial account compromise and token theft.
- **Hardening recommendations:**
- Review and restrict permissions for the Microsoft Graph API.
- Audit and limit the use of SSO for third-party platforms to only necessary personnel.
- Enable "Advanced Auditing" in M365 to capture more granular telemetry.
## Related Tools/Techniques
- **Token Theft/Pass-the-Cookie:** Used to bypass MFA.
- **Microsoft Graph API:** The primary interface for programmatic M365 interaction.
- **Vishing:** Voice-based social engineering used for initial access.