M365Pwned

M365Pwned Herramientas de Red Team para la explotación de Microsoft 365 mediante la API de Microsoft Graph. Dos herramientas GUI de WinForms para enumerar, buscar y extraer datos de entornos M365 utilizando tokens OAuth a nivel de aplicación — sin interacción del usuario. Herramienta| Objetivo| Q...

o365-attack-toolkit

What is o365-attack-toolkit o365-attack-toolkit allows operators to perform oauth phishing attacks. We decided to move from the old model of static definitions to fully "interactive" with the account in real-time. Some of the changes Interactive E-mail Search - Allows you to search for user e-mai...

GraphStrike

GraphStrike 发布博客：GraphStrike：利用Microsoft Graph API使Beacon流量消失 开发者博客：GraphStrike：攻击性工具开发剖析 简介 GraphStrike 是一套工具套件，使 Cobalt Strike 的 HTTPS Beacon 能够通过 Microsoft Graph API 进行 C2 通信。所有 Beacon 流量将通过攻击者 SharePoint 站点中创建的两个文件传输，并且来自 Beacon 的所有通信将路由至 https://graph.microsoft.com： GraphStrike 包含一个配置器，用于创建通...

reportly

Reportly is an EntraID user activity report tool. About the tool This is a tool that will help blue teams during a cloud incident. When running the tool, the researcher will enter as input a suspicious user and a time frame and will receive a report detailing the following: 1. Information about t...

reportly

Reportly 是一款 EntraID 用户活动报告工具。 关于本工具 本工具旨在帮助蓝队在云安全事件调查中快速获取信息。 运行时，研究者输入可疑用户和时间范围，即可生成一份详细报告，内容包括： 1. 用户信息 2. 用户执行的操作 3. 针对用户执行的操作 4. 用户登录及失败日志 使用方法 运行工具时，会显示身份验证链接和设备代码，请访问链接并输入代码完成验证。 输入可疑用户的用户主体名称（User Principal Name）。 按以下格式输入开始和结束时间：2022-11-16 建议时间跨度不超过一周。 报告生成完毕后，工具会输出“Your report is...

azureOutlookC2

Azure Outlook C2 基于Azure Outlook的命令与控制工具，利用Microsoft Graph API进行C2通信和数据外泄。 通过Outlook邮箱远程控制被入侵的Windows设备。 创建者：Bobby Cooke @0xBoku & Paul Ungur @C5pider CTI威胁更新（2022年2月13日） Elastic安全实验室发现活跃入侵活动正在野外使用SIESTAGRAPH。SIESTAGRAPH利用Microsoft Graph API通过Outlook和OneDrive进行命令与控制。请查看下方关于Azure Outlook...

Harvester Deploys Linux GoGra Backdoor in South Asia Using Microsoft Graph API

The threat actor known as Harvester has been attributed to a new Linux version of its GoGra backdoor deployed as part of attacks likely targeting entities in South Asia. "The malware uses the legitimate Microsoft Graph API and Outlook mailboxes as a covert command-and-control C2 channel, allowing...

What Microsoft's EWS Retirement Means for Your Veeam Backups

Updated September 2026 This article has been revised to reflect: Microsoft's October 1, 2026 enforcement timeline. The introduction of the EWSAllowedAppIDs allow list. The current status of Veeam's transition to Microsoft Graph. Customers who have previously read this article are advised to revie...

EUVD-2024-0260

Malicious code in bioql PyPI...

New Malware Campaign Exploits Microsoft Graph API to Infect Windows

FortiGuard Labs discovers an advanced attack using modified Havoc Demon and SharePoint. Explore the attack's evasion techniques and security measures...

FINALDRAFT Malware Exploits Microsoft Graph API for Espionage on Windows and Linux

Threat hunters have shed light on a new campaign targeting the foreign ministry of an unnamed South American nation with bespoke malware capable of granting remote access to infected hosts. The activity, detected in November 2024, has been attributed by Elastic Security Labs to a threat cluster i...

CVE-2024-21632

omniauth-microsoftgraph provides an Omniauth strategy for the Microsoft Graph API. Prior to versions 2.0.0, the implementation did not validate the legitimacy of the email attribute of the user nor did it give/document an option to do so, making it susceptible to nOAuth misconfiguration in cases...

New Go-based Backdoor GoGra Targets South Asian Media Organization

An unnamed media organization in South Asia was targeted in November 20233 using a previously undocumented Go-based backdoor called GoGra. "GoGra is written in Go and uses the Microsoft Graph API to interact with a command-and-control C&C server hosted on Microsoft mail services," Symantec, part ...

Hackers Increasingly Abusing Microsoft Graph API for Stealthy Malware Communications

Threat actors have been increasingly weaponizing Microsoft Graph API for malicious purposes with the aim of evading detection. This is done to "facilitate communications with command-and-control C&C infrastructure hosted on Microsoft cloud services," the Symantec Threat Hunter Team, part of...

CVE-2024-21632

omniauth-microsoftgraph provides an Omniauth strategy for the Microsoft Graph API. Prior to versions 2.0.0, the implementation did not validate the legitimacy of the email attribute of the user nor did it give/document an option to do so, making it susceptible to nOAuth misconfiguration in cases...

Information disclosure

omniauth-microsoftgraph provides an Omniauth strategy for the Microsoft Graph API. Prior to versions 2.0.0, the implementation did not validate the legitimacy of the email attribute of the user nor did it give/document an option to do so, making it susceptible to nOAuth misconfiguration in cases...

CVE-2024-21632 omniauth-microsoft_graph vulnerable to account takeover (nOAuth)

omniauth-microsoftgraph provides an Omniauth strategy for the Microsoft Graph API. Prior to versions 2.0.0, the implementation did not validate the legitimacy of the email attribute of the user nor did it give/document an option to do so, making it susceptible to nOAuth misconfiguration in cases...

CVE-2024-21632 omniauth-microsoft_graph vulnerable to account takeover (nOAuth)

omniauth-microsoftgraph provides an Omniauth strategy for the Microsoft Graph API. Prior to versions 2.0.0, the implementation did not validate the legitimacy of the email attribute of the user nor did it give/document an option to do so, making it susceptible to nOAuth misconfiguration in cases...

CVE-2024-21632 omniauth-microsoft_graph vulnerable to account takeover (nOAuth)

omniauth-microsoftgraph provides an Omniauth strategy for the Microsoft Graph API. Prior to versions 2.0.0, the implementation did not validate the legitimacy of the email attribute of the user nor did it give/document an option to do so, making it susceptible to nOAuth misconfiguration in cases...

Microsoft Incident Response lessons on preventing cloud identity compromise

Microsoft observed a surge in cyberattacks targeting identities in 2023, with attempted password-based attacks increasing by more than tenfold in the first quarter of 2023 compared to the same period in 2022. Threat actors leverage compromised identities to achieve a significant level of access t...