Entra ID Setup

1. App Registration - Create in Azure Portal > Microsoft Entra ID > App registrations
2. Client Secret - Generate under Certificates & secrets
3. API Permissions - Grant application permissions and admin consent:
   • ChannelMessage.Read.All - Read channel messages
   • ChannelMessage.Send - Send channel messages
4. Team & Channel IDs - Get via Graph Explorer or the Teams client channel link

If ChannelMessage.Send is not available, use Group.ReadWrite.All or configure a webhook URL.

Full setup instructions are in the Mythic documentation page after installation at https://<your-mythic-server>:7443/docs/c2-profiles/msteams.

Configuration

Edit via the Mythic UI: C2 Profiles > msteams > View/Edit Config.

Compatible Agents

• Starburst - Full support via WinHTTP-based MS Teams transport

Any Mythic agent that implements the msteams C2 profile parameters can use this profile. The agent needs to:

1. Authenticate to the Graph API using the configured credentials
2. Post base64-encoded Mythic messages to the configured Teams channel
3. Poll the channel for responses from the C2 server

Testing Without Azure

A mock test infrastructure is included in test/ for local testing without any Azure or M365 account. This lets you test the full C2 pipeline — including compiled implants — against a local fake Graph API.

Mock Server Setup

1. Copy test/mock_server.py to your Mythic host and start it:

   root@kitploit:~

   python3 mock_server.py
   

   This starts a fake Graph API on port 8443.

2. Configure the msteams C2 profile in Mythic with mock values:

   root@kitploit:~

   {
     "tenant_id": "fake-tenant-id",
     "client_id": "fake-client-id",
     "client_secret": "fake-client-secret",
     "team_id": "fake-team-id",
     "channel_id": "fake-channel-id",
     "graph_base": "http://<mythic-host-ip>:8443/v1.0",
     "login_base": "http://<mythic-host-ip>:8443",
     "poll_interval": 3,
     "clear_messages": true,
     "debug": true
   }
   

3. Start the msteams profile in the Mythic UI.

Testing with a Compiled Implant (Starburst)

To test a real compiled agent against the mock, the agent binary needs to be built with the mock server's IP and port hardcoded instead of the real Graph API endpoints. In the Starburst agent code (agent_code/src/transport/msteams.cc):

Then reinstall Starburst, build a payload with the msteams profile (using the same fake tenant/client/team/channel IDs), and run it on a Windows VM that can reach the Mythic host.

Remember to revert these changes before building production payloads:

Testing with the Fake Agent (No Compilation)

For a quick pipeline test without compiling an agent:

See test/README.md for more details.

OPSEC Considerations

• Use a dedicated private channel with minimal membership
• Enable clear_messages to clean up after processing
• Keep poll_interval reasonable (10-30s) to avoid rate limiting
• All messages are AES256-encrypted at the Mythic payload level
• Teams messages are NOT end-to-end encrypted (visible to tenant admins and Microsoft)
• The Graph API rate limit is approximately 30 requests per second per app per tenant

File Structure