Proactive Strategies Against “.onmicrosoft.com” Phishing Attacks

Introduction

Recently, there has been a notable surge in the utilization of “. onmicrosoft.com” domains in phishing activities. Malicious actors are creating numerous trial Microsoft 365 accounts and automatically activating Exchange Online to facilitate the dissemination of phishing emails as a temporary strategy.

During a specific instance, I identified nearly 100 distinct “. onMicrosoft” domains transmitting identical phishing emails across various target domains within a few hours. Given that these phishing attempts were successfully evading multiple security protocols, it became imperative to swiftly implement enhanced measures to fortify the targeted domains against such orchestrated campaigns. Additionally, I instituted a comprehensive monitoring system to keep tabs on all emails quarantined because of our newly implemented measures. This proactive approach accounted for potential false positives, especially considering instances where users might be engaging with Exchange Online tenants that could be misconfigured.

Look for emails from the domain a.onmicrosoft.com

Below, you’ll find a sample of Kusto Query Language (KQL) code designed to generate a report that identifies all incoming emails received in the last 30 days from a domain with an .onmicrosoft.com extension. It is imperative to conduct a detailed analysis of this data before considering any actions to quarantine these emails, as there is a risk of encountering false positives.

Once a thorough examination of the data is complete and you have assessed the potential implications of implementing a Mail Flow rule to quarantine these emails, the next step involves creating a detection mechanism for all incoming emails that will be directed to quarantine after implementing the Mail Flow rule.

Crafting an Alert Rule for.onmicrosoft.com Emails Rerouted to Quarantine by a Mail Flow Rule

Deciphering this proved to be a challenge. When configuring a Mail Flow rule to divert an email to quarantine, the relevant information can be in the defender portal, specifically under Email Entity analysis data, as depicted below. However, it seems that this data is not accessible within the advanced hunting data. Although EmailEvents and the additional data field contain some information, it does not seem to be present when implementing a Mail Flow rule to quarantine the message.

Typically, when EOP & MDO relegates an email to quarantine, the Email Action field is filled with the information “Send to quarantine.” Nevertheless, if you direct an email explicitly to quarantine using a Mail Flow rule, this field stays unpopulated. The subsequent detection approach assumes the presence of a singular Mail Flow rule responsible for directing.onmicrosoft.com domain emails to quarantine. This enables us to pinpoint emails from the.onmicrosoft.com domain precisely routed to quarantine through the impending Mail Flow rule.

Establish a mail flow directive to route emails from a.onmicrosoft.com domain to quarantine

Step 1: Sign in to the Exchange Admin Centre

Link: aka.ms/admincenter

Step 2: Navigate to the “Admin Centre” in the bottom right corner and click on Exchange.

Step 3: Create a new rule with conditions.

1. Apply this Rule if*

The Sender -> address matches any of the text patterns .onmicrosoft.com

2. Do the Following

Redirect the Message to -> Hosted Quarantine

Moreover, ensure that end-users receive alerts whenever an email is sent to quarantine. Provide them with the ability to preview and request the release of emails from quarantine, facilitating more convenient management.

Conclusion

Drop a query if you have any questions regarding Phishing and we will get back to you quickly.

About CloudThat