Links

[randomaccess3]

• [x] https://www.mandiant.com/resources/blog/apt29-continues-targeting-microsoft
• [x] https://www.inversecos.com/2022/08/how-to-detect-oauth-access-token-theft.html
• [x] https://redcanary.com/blog/o365-email-rules-mindmap/
• [x] https://techcommunity.microsoft.com/t5/security-compliance-and-identity/forensic-artifacts-in-office-365-and-where-to-find-them/ba-p/3634865
• [x] https://redcanary.com/blog/email-payroll-diversion-attack/
• [x] https://www.crowdstrike.com/blog/observations-from-the-stellarparticle-campaign/
• [x] https://github.com/cisagov/ScubaGear
• [x] https://malwaremaloney.blogspot.com/2022/12/azure-app-ids.html
• [x] https://www.aon.com/cyber-solutions/aon_cyber_labs/scl-1-the-dangerous-side-of-safe-senders/
• [x] https://www.avertium.com/resources/threat-reports/mitm-attacks-evilproxy-and-evilginx
• [x] https://expel.com/blog/seven-ways-to-spot-business-email-compromise-office-365/
• [x] https://techcommunity.microsoft.com/t5/microsoft-security-experts-blog/good-ual-hunting/ba-p/3718421
• [x] https://techcommunity.microsoft.com/t5/microsoft-security-experts-blog/forensic-artifacts-in-office-365-and-where-to-find-them/ba-p/3634865