Full Report
Dive into how Huntress caught a threat actor adding several legitimate email apps to maintain persistent access to a compromised Microsoft 365 environment.
Analysis Summary
# Tool/Technique: Traitorware (M365 Application Persistence)
## Overview
This technique involves threat actors leveraging legitimate third-party Microsoft 365 (M365) applications to maintain persistent access to a compromised environment. By registering or authorizing legitimate apps (like email clients or productivity tools) and granting them specific OAuth permissions, attackers can bypass multi-factor authentication (MFA) and password changes, maintaining a "backdoor" into the user's mailbox without the need for traditional malware.
## Technical Details
- **Type:** Technique / Persistence Mechanism
- **Platform:** Microsoft 365 / Azure Active Directory (Microsoft Entra ID)
- **Capabilities:** Persistent mailbox access, automated data synchronization, bypass of MFA/Password resets, long-term session maintenance via refresh tokens.
- **First Seen:** Case study published August 3, 2023.
## MITRE ATT&CK Mapping
- **TA0003 - Persistence**
- **T1136.003 - Create Account: Cloud Account** (via Service Principal creation)
- **T1098.003 - Account Manipulation: Additional Email Delegate Permissions**
- **TA0004 - Privilege Escalation**
- **T1098 - Account Manipulation**
- **TA0006 - Credential Access**
- **T1528 - Steal Application Access Token** (via OAuth consent)
## Functionality
### Core Capabilities
- **OAuth Delegation:** The technique exploits the OAuth 2.0 flow. Once a user account is compromised, the attacker authorizes a legitimate app (e.g., **eM Client**, **Thunderbird**, **Airmail**) to access the account.
- **Token Refreshing:** By securing the `offline_access` scope, the application receives a refresh token. This allows the attacker to generate new access tokens indefinitely, even if the user changes their password, as the "grant" remains active in Azure.
- **Protocol Abuse:** Uses legitimate protocols like Exchange Web Services (EWS) or IMAP/SMTP via the authorized app to exfiltrate data or monitor communications.
### Advanced Features
- **Stealth via Legitimacy:** Because the applications used (e.g., eM Client) are legitimate software with valid certificates, they are less likely to trigger endpoint or network-based security alerts.
- **MFA Bypass:** Once the initial consent is granted (often requiring MFA if enabled), subsequent access by the application typically does not prompt for MFA, allowing the attacker to re-enter the environment silently.
## Indicators of Compromise
- **File Names:** Not applicable (Cloud-based persistence), but look for the installation of legitimate email clients on non-standard systems.
- **Network Indicators:** Successful logins from known VPN/Proxy provider IP addresses followed by administrative Azure AD changes.
- **Behavioral Indicators:**
- Audit log event: `Add service principal` for unexpected third-party apps.
- Audit log event: `Add delegated permission grant`.
- Permission Scopes: Look for `EWS.AccessAsUser.All`, `offline_access`, `email`, and `openid` being granted to new apps.
- Unusual User-Agent strings in M365 logs associated with third-party email clients.
## Associated Threat Actors
- Used primarily by **Business Email Compromise (BEC)** actors.
- Generic threat actors focusing on financial fraud and data exfiltration.
## Detection Methods
- **Log Analysis:** Monitor Azure AD (Entra ID) Audit Logs for `Consent to application` and `Add delegated permission grant` events, especially from accounts that recently showed "Impossible Travel" or Proxy/VPN logins.
- **Inventory Review:** Regularly audit the **Enterprise Applications** and **App Registrations** blades in the Azure portal for unauthorized or suspicious software.
- **Behavioral detection:** Alerting on the specific combination of a successful login from a new IP followed immediately by the registration of a service principal.
## Mitigation Strategies
- **App Integration Policies:** Restrict the ability of non-admin users to consent to third-party applications (Disable "Users can consent to apps accessing company data on their behalf").
- **Admin Consent Workflow:** Implement a workflow where an administrator must review and approve all third-party app requests.
- **Conditional Access:** Apply policies that require compliant devices or specific network locations for any application authentication.
- **Revocation:** During incident response, ensure that "Revoke Sessions" is performed AND that all suspicious OAuth grants are manually removed from the user's account settings in Azure.
## Related Tools/Techniques
- **Illicit Consent Grant Attacks:** A broader category where attackers trick users into clicking a malicious consent link.
- **App-in-the-Middle:** Using malicious apps to intercept tokens.
- **Legacy Authentication Abuse:** Using IMAP/POP3 to bypass modern security controls (often used in conjunction with these apps).