Threat hunts for Microsoft 365

25 hunts

1. high Part 2 of 2

   Research by Huntress

   Cloud Identity Hijacking and Mailbox Persistence

   An adversary has bypassed multi-factor authentication via session token theft or device code phishing and established persistence by modifying mailbox rules to hide intercepted communications.

   3 query1 analytic1 checkpoint1 action2 task

   command and control · credential access · execution
2. high Part 1 of 2

   Research by Huntress

   Endpoint Social Engineering and Malicious Execution

   An attacker has used AI-tuned phishing lures or ClickFix social engineering to trick a user into executing shell commands from the Run box, eventually deploying rogue RMM tools or infostealers.

   5 query2 analytic1 checkpoint1 action2 task

   command and control · credential access · execution
3. medium

   Research by Microsoft

   Detection of Phishing and Agent-Driven Exfiltration

   An intruder has used a phishing attack to bypass multi-factor authentication and is now using compromised productivity applications to exfiltrate data over a C2 channel.

   3 query1 analytic1 checkpoint1 action2 task

   exfiltration · initial access
4. high

   Research by Cisco Talos

   UAT-11587 Antino Backdoor Phased Infection and M365 C2

   An adversary is using Cloudflare-hosted stagers to deliver the Rust-compiled Antino backdoor, which then establishes persistence via Run keys and communicates using Microsoft 365 as a dead-drop C2 channel.

   5 query2 analytic1 checkpoint1 action2 task

   command and control · discovery · execution
5. medium Part 2 of 2

   Research by ESET Research

   EDR Impairment and Ransomware Impact

   An adversary is stealing credentials from browser stores and attempting to disable security controls using vulnerable drivers before launching a high-volume ransomware or exfiltration attack.

   3 query1 analytic1 checkpoint1 action2 task

   credential access · defense evasion · execution
6. medium Part 1 of 2

   Research by ESET Research

   AI Agent and Social Engineering Initial Access

   An adversary has gained initial access by using AI-generated phishing lures, malicious AI skills, or ClickFix social engineering where users paste malicious terminal commands.

   5 query2 analytic1 checkpoint1 action2 task

   credential access · defense evasion · execution
7. high

   Research by Cisco Talos

   M365 Session Hijacking and Malware Execution

   An adversary has bypassed MFA by stealing M365 session tokens via DocuSign-themed phishing, enabling them to execute malicious droppers and deploy ransomware across the fleet.

   5 query2 analytic1 checkpoint1 action2 task

   credential access · execution · impact
8. high

   Research by Rapid7

   SharePoint Business Data Connectivity Service Exploitation

   An attacker has exploited the SharePoint Business Data Connectivity service by uploading a malicious BDC model file to instantiate a .NET gadget chain, resulting in remote code execution within the IIS worker process context.

   3 query1 analytic1 checkpoint1 action2 task

   CVE-2019-1257 · CVE-2026-55040
9. high Part 1 of 2

   Research by Huntress

   Sideloaded AppX OAuth Token Theft

   An adversary has enabled Developer Mode and sideloaded a malicious AppX package to abuse WWAHost.exe, allowing them to capture MFA-compliant OAuth tokens via a legitimate Microsoft login dialog.

   3 query1 analytic1 checkpoint1 action2 task

   credential access · defense evasion · execution
10. high Part 1 of 2

    Research by Microsoft

    EvilTokens Client-Side Phishing Interaction

    An intruder has delivered an AI-tailored phishing lure that, when opened, initiates high-frequency background polling to a malicious Node.js endpoint while redirecting the user to the Microsoft device login portal.

    3 query1 analytic1 checkpoint1 action2 task

    collection · credential access · execution
11. high

    Research by Elastic Security Labs

    Rapid Phishing and Proxy-based Exfiltration

    An adversary has bypassed phishing-resistant MFA to gain initial access via a SaaS provider and is now using a multi-hop proxy or tunnel to exfiltrate data from an internal host.

    3 query2 analytic2 checkpoint1 action2 task

    command and control · exfiltration · initial access
12. medium

    Research by Microsoft

    Managed Access and Tenant Integrity

    An adversary has established persistence via cross-tenant delegated administration or unattended remote support, subsequently deploying autonomous agents that communicate through multi-hop proxies.

    5 query2 analytic1 checkpoint1 action2 task

    command and control · execution · persistence
13. high

    Research by Microsoft

    AI-Themed Social Engineering and Multi-Stage Fraud

    An adversary is using lookalike AI domains and installers to trick users into downloading stealers or performing device-code authentication, leading to token theft and financial fraud.

    5 query2 analytic1 checkpoint1 action2 task

    credential access · execution · impact
14. high

    Research by Huntress

    AD RMS Discovery and Administrative Reconnaissance

    An adversary is identifying on-premises AD RMS clusters via DNS and rights-policy template enumeration before escalating privileges via local group membership to reach the administrative surface.

    5 query2 analytic1 checkpoint1 action2 task

    command and control · discovery · privilege escalation
15. high Part 2 of 2

    Research by Huntress

    Knight Office Token Theft and Device Persistence

    An adversary has stolen Microsoft 365 session tokens via a device-code phishing flow and secured persistence by enrolling an unauthorized rogue device into the Entra ID tenant.

    3 query1 analytic1 checkpoint1 action3 task

    credential access · initial access · persistence
16. high Part 1 of 2

    Research by Huntress

    Knight Office Phishing Delivery and Redirects

    An adversary is using Monday.com redirects and .vu landing pages to deliver Knight Office phishing lures to M365 users.

    3 query1 analytic1 checkpoint1 action2 task

    credential access · initial access · persistence
17. high Part 2 of 2

    Research by Unit 42

    Spring Ring: NTLM Relay and RAT C2

    An attacker has deployed a custom Python environment to facilitate NTLM relay attacks and a PowerShell-based RAT that beacons to external command-and-control infrastructure.

    3 query1 analytic1 checkpoint1 action2 task

    command and control · defense evasion · discovery
18. high Part 1 of 2

    Research by Unit 42

    Microsoft Teams Vishing and Malicious Payload Execution

    An adversary is using external Microsoft Teams accounts to masquerade as IT support and coerce employees into executing RMM tools or custom payloads that perform discovery and persistence.

    5 query2 analytic1 checkpoint1 action2 task

    command and control · defense evasion · discovery
19. medium

    Research by Microsoft

    Interaction with BEC Lookalike Infrastructure

    An employee has received a BEC email and is interacting with lookalike infrastructure to view a fake invoice or initiate a fraudulent payment.

    3 query2 analytic2 checkpoint1 action2 task

    initial access · reconnaissance · resource development
20. high

    Research by Rapid7

    SharePoint Unauthenticated Remote Code Execution

    An attacker is exploiting the CVE-2026-55040 and CVE-2026-63520 chain to bypass authentication and execute arbitrary commands via the SharePoint worker process on unpatched servers.

    3 query1 analytic1 checkpoint2 task

    CVE-2026-55040 · CVE-2026-63520
21. high

    Research by Microsoft

    Unicode-Smuggling Financial Phishing Evasion

    An adversary is using invisible Unicode tag characters to split keywords in finance-themed phishing lures, bypassing traditional email filters and redirecting victims to disposable infrastructure.

    4 query2 analytic2 checkpoint1 action2 task

    command and control · defense evasion · initial access
22. high Part 2 of 2

    Research by Microsoft

    Microsoft Graph and Cloud Application Exfiltration

    An adversary is using automated Graph API tools to enumerate organizational resources and exfiltrate SharePoint/OneDrive data after obtaining a cloud session via passkey-themed social engineering.

    4 query1 analytic1 checkpoint1 action2 task

    discovery · exfiltration · initial access
23. high Part 2 of 2

    Research by Volexity

    VerdantBamboo Stolen Credential and Pivot Hunt

    An adversary has used stolen administrative or service account credentials to access edge appliances via VPN or SSH, subsequently using web-based management interfaces to pivot further or deploy persistence.

    3 query1 analytic1 checkpoint1 action2 task

    command and control · execution · initial access
24. high Part 1 of 2

    Research by Volexity

    VERDANTBAMBOO Edge Appliance Post-Exploitation

    An adversary compromises an edge appliance, uses an inadvertent sudo configuration to escalate to root, and creates persistence via cron to tunnel traffic through DNS-over-HTTPS.

    5 query2 analytic1 checkpoint1 action2 task

    command and control · execution · initial access
25. high

    Research by Sekoia

    MuddyRot Custom Implant Lifecycle

    An intruder has deployed the MuddyRot implant on a public-facing server, establishing persistence via a custom scheduled task and initiating a reverse shell to known Iranian C2 infrastructure.

    6 query2 analytic1 checkpoint1 action2 task

    command and control · execution · initial access