Illicit OAuth App-Consent Grant: Entra ID Impersonation Campaign
A mass illicit OAuth app-consent campaign against a maritime logistics tenant. Operators register multitenant Entra apps impersonating trusted SaaS brands (iLSMART, Adobe, DocuSign, OneDrive-2025) and send brand-themed consent lures from compromised supplier accounts. Victims who click are screened by a Tycoon antibot redirector into an adversary-in-the-middle relay that proxies the real Entra sign-in, harvests the password, and intercepts the MFA-approved token. The replayed token completes user-level consent grants to the impersonation apps, which read mailboxes over Microsoft Graph, and the attacker registers a new MFA method for durable persistence. Work the Email lures and the Entra consent, sign-in, Graph, and security-info audit to reconstruct the chain.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Incident brief
0Orient yourself before pivoting into the data. This is a no-answer briefing checkpoint.
Locate the first compromised identity
35One cloud account was relayed through an external IP the tenant does not recognize, after a burst of failed attempts. Identify it.
Identify the app the analyst consented to
40The attacker's foothold is an application, not a password. Identify the application (client) ID of the impersonation app the first victim granted delegated Graph permissions.
Expose the impersonation app's true reply URL
35The app claims a trusted brand but its redirect betrays it. Report the reply URL recorded on the morning consent grant.
Catch the relay redirector in the lure
30Before any sign-in, the lure forwarded the analyst through a screening redirector. Identify the antibot redirector domain in the iLSMART lure.
Find the persistence registered on the second victim
30The afternoon victim's account changed in a way that survives a password reset. Identify what the attacker added.
Classify the MFA-bypass technique
30Name how the attacker authenticated as the victims without re-prompting MFA. Map the relayed-token reuse to its MITRE ATT&CK technique.
7 tasks · 200 points total
Training Tools
Cloud Console
Cloud infrastructure logs
Email Console
Email header & content analysis
Skills You'll Build
Requires foundational alert triage skills. Multiple data sources to correlate.
Prerequisites
- Basic understanding of security alerts
- Familiarity with Cloud concepts
- Familiarity with Email concepts
Ready to investigate?
More Operations
View allDocker Hub Supply Chain: A Public Image on a Shared Build Runner
A platform engineer pulls a public Docker Hub image advertised as a network scanning utility onto a shared Linux build-runner. Hours later the host is still pinned at full CPU with its build queue drained, nothing deployed and no data alarms raised. Reconstruct what the image actually did on the host from endpoint XDR and perimeter firewall telemetry, and classify the key ATT&CK techniques.
Cookie Heist: AiTM Session Theft to Payment-Fraud BEC
An adversary-in-the-middle phishing intrusion that turns into payment fraud without any malware. A voicemail-themed email with an HTML attachment routes a finance analyst through a redirector to an Evilginx2 proxy, which relays her real Microsoft 365 sign-in and steals the post-MFA session cookie. The attacker replays the cookie from a foreign hosting IP, bypassing MFA, then reads her mailbox, creates an email-hiding inbox rule keyed on a vendor's domain, deletes the phishing mail, and replies inside a live invoice thread asking the vendor to wire payment to a new account. Work the Entra sign-in audit, the Exchange Online mailbox operations, and the email evidence to reconstruct the chain.
Key Vault Contributor Privilege Escalation: Reading All Secrets via Access Policies
A holder of the built-in Key Vault Contributor role abuses its Microsoft.KeyVault/vaults/write permission to write itself a full data-plane access policy on a production Azure Key Vault, then dumps every secret, key, and certificate it holds. Working purely from the cloud audit trail, correlate the control-plane access-policy change in the Azure Activity Log with the data-plane secret, key, and certificate reads in the Key Vault diagnostic log, identify the principal and what it stole, and classify the privilege-escalation and credential-access techniques.