Awesome-BEC

Repository of attack and defensive information for Business Email Compromise investigations

Office365/AzureAD

• ATT&CK O365
• ATT&CK Azure
• Microsoft Azure Threat Research Matrix
• Microsoft 365 Licensing
• Microsoft Portals
• Azure App IDs
• Microsoft First Party App IDs & Graph Permissions
• Well-known Microsoft Client IDs

Attack/Defend Research

Author	Link
Lina Lau	Backdoor Office 365 and Active Directory - Golden SAML
Lina Lau	Office365 Attacks: Bypassing MFA, Achieving Persistence and More - Part I
Lina Lau	Attacks on Azure AD and M365: Pawning the cloud, PTA Skeleton Keys and more - PART II
Mike Felch and Steve Borosh	Socially Acceptable Methods to Walk in the Front Door
Mandiant	Remediation and Hardening Strategies for Microsoft 365 to Defend Against UNC2452
Andy Robbins at SpecterOps	Azure Privilege Escalation via Service Principal Abuse
Emilian Cebuc & Christian Philipov at F-Secure	Has anyone seen the principal?
nyxgeek at TrustedSec	Creating A Malicious Azure AD Oauth2 Application
Lina Lau	How to Backdoor Azure Applications and Abuse Service Principals
Lina Lau	How to Detect Azure Active Directory Backdoors: Identity Federation
Doug Bienstock at Mandiant	PwnAuth
Steve Borosh at Black Hills Information Secucirty	Spoofing Microsoft 365 Like It’s 1995
Avertium	MITM Attacks - Evilproxy and Evilginx
Aon Cyber Labs	Bypassing MFA: A Forensic Look At Evilginx2 Phishing Kit
Sofia Marin	Incident Response Series: Chapter #1 Phishing and cookie stolen with Evilginx.
Sofia Marin	Incident Response Series: Chapter #3 The Impact and Subscription Theft as Exfiltration
Anish Bogati	Tricked by trust: How OAuth and device code flows get abused

Investigation Research