Huntress launches ITDR Lookback to find pre-onboarding Microsoft 365 compromises, citing three active intrusions in early testing
Huntress announced general availability of the Managed ITDR Lookback feature. It reviews up to 180 days of Microsoft 365 login history for newly onboarded tenants, looking for compromises that predate monitoring. Active compromises trigger a critical Incident Report, SOC investigation and session revocation. Previously remediated ones are recorded in the Identity Security Assessment as historical context. In the first two weeks of early testing, Huntress reviewed more than 400 tenants and found three with an active compromise already in progress. This is primarily vendor product news, though the case studies illustrate common Microsoft 365 identity attack patterns.
Detalhes técnicos
- Lookback applies Huntress's Unwanted Access detections to historical logins: credential theft, token theft, adversary-in-the-middle (AiTM) attacks, suspicious browsers and datacenter logins.
- Title company: device-code phishing gave the attacker access three days before onboarding. The attacker persisted through a rogue Entra device and was watching a $2 million real estate wire transfer.
- School district: a Global Admin account was compromised 27 days before onboarding. An unrevoked refresh token and a rogue Azure AD device kept the access alive.
- Architecture firm: the attacker had a nine-day foothold, a hidden inbox rule, and sent 103 external OneDrive phishing invitations in a single scripted second, turning the account into phishing infrastructure.
- No IOCs, CVEs or named threat actors were disclosed.
Remediação
- When taking over or onboarding a Microsoft 365 tenant, review historical sign-in logs for token theft, AiTM and datacenter logins.
- Revoke refresh tokens and active sessions, not just passwords, after a suspected compromise.
- Audit registered Entra/Azure AD devices, inbox rules and rogue apps.
- Restrict or monitor device-code authentication flows.
Linha do tempo
-
Huntress launches ITDR Lookback to find pre-onboarding Microsoft 365 compromises, citing three active intrusions in early testing
ler a análise desta fonte ocultar
Huntress announced general availability of the Managed ITDR Lookback feature. It reviews up to 180 days of Microsoft 365 login history for newly onboarded tenants, looking for compromises that predate monitoring. Active compromises trigger a critical Incident Report, SOC investigation and session revocation. Previously remediated ones are recorded in the Identity Security Assessment as historical context. In the first two weeks of early testing, Huntress reviewed more than 400 tenants and found three with an active compromise already in progress. This is primarily vendor product news, though the case studies illustrate common Microsoft 365 identity attack patterns.
Technical Details
- Lookback applies Huntress's Unwanted Access detections to historical logins: credential theft, token theft, adversary-in-the-middle (AiTM) attacks, suspicious browsers and datacenter logins.
- Title company: device-code phishing gave the attacker access three days before onboarding. The attacker persisted through a rogue Entra device and was watching a $2 million real estate wire transfer.
- School district: a Global Admin account was compromised 27 days before onboarding. An unrevoked refresh token and a rogue Azure AD device kept the access alive.
- Architecture firm: the attacker had a nine-day foothold, a hidden inbox rule, and sent 103 external OneDrive phishing invitations in a single scripted second, turning the account into phishing infrastructure.
- No IOCs, CVEs or named threat actors were disclosed.
Remediation
- When taking over or onboarding a Microsoft 365 tenant, review historical sign-in logs for token theft, AiTM and datacenter logins.
- Revoke refresh tokens and active sessions, not just passwords, after a suspected compromise.
- Audit registered Entra/Azure AD devices, inbox rules and rogue apps.
- Restrict or monitor device-code authentication flows.