Clankerusecase
Microsoft 365 detection coverage
 ← Back to main site
Home/ Targets/ Microsoft 365

📧Microsoft 365 detections

Clankerusecase tracks 43 detection use cases covering the Microsoft 365 attack surface across 41 MITRE ATT&CK techniques.

Detections targeting Microsoft 365 — Exchange / SharePoint / Teams / OfficeActivity.

Open Detection Library → View on the matrix
43Use cases
41Techniques
60Articles
4Kill-chain phases

Top techniques on Microsoft 365 (25)

T1566.002Spearphishing Link15T1566.001Spearphishing Attachment8T1114.003Email Forwarding Rule5T1530Data from Cloud Storage5T1567Exfiltration Over Web Service5T1204.002Malicious File4T1204.001Malicious Link4T1195.002Compromise Software Supply Chain4T1656T16564T1583.001Domains3T1564.008Email Hiding Rules3T1098.002Additional Email Delegate Permissions2T1556Modify Authentication Process2T1528Steal Application Access Token2T1550.001Application Access Token2T1078.004Cloud Accounts2T1213.002Sharepoint2T1598.003Spearphishing Link2T1071.003Mail Protocols2T1114Email Collection2T1098Account Manipulation1T1059.001PowerShell1T1566.004Spearphishing Voice1T1566Phishing1T1098.001Additional Cloud Credentials1

Delivery (21)

Email attachment opened from external sender Internal delivery · hunting DSP Phishing-link click correlated to endpoint execution Internal delivery · alerting DSP User clicked through a Safe Links warning page Internal delivery · alerting DS Click on URL whose host doesn't match the sender domain Internal delivery · hunting DS Microsoft Teams external-tenant chat from unverified IT-helpdesk impersonator Internal delivery · hunting DSP [LLM] Inbound email from F6 fraud clone domain (ruspromexport-group.ru / info@ruspromexport-group.ru) Bespoke delivery · alerting DS [LLM] Compromised M365 mailbox fan-out of QR-code PDF phishing (UAT-11764) Bespoke delivery · alerting DSP [LLM] Inbound phishing from BEC sender domain 9i6pokerdepot.com (Q2 2026 ClickUp/pixeldrain chain) Bespoke delivery · alerting DSP [LLM] Inbound HTML-attachment lure exploiting Zimbra XSS (CVE-2025-66376) Bespoke delivery · hunting DS [LLM] Inbound phishing email or URL referencing npm look-alike domain npmjs.help Bespoke delivery · alerting DSP [LLM] Law-firm / order-confirmation lure delivering device-code phish via cacoo.com and allianceinvestigators.com Bespoke delivery · hunting DS [LLM] EvilTokens device-code lure email (Acrobat/DocuSign decoy, 'Verify to view') Bespoke delivery · alerting DSP [LLM] BTMOB Android RAT APK SHA256 sighting in file or email telemetry Bespoke delivery · hunting DSΣPDDCS [LLM] Mail-borne click to fake FIFA World Cup 2026 phishing domain Bespoke delivery · alerting DSΣPDDCS [LLM] Mailcow quarantine XSS via EICAR + HTML in attachment filename (GHSA-2xjc-rg88-jvpp) Bespoke delivery · alerting DSΣPDD [LLM] Silver Fox Japan tax-season lure: inbound email with Japanese HR/ESOP subject + gofile.io URL or RAR/ZIP Bespoke delivery · alerting DS [LLM] PlugX phishing lure — 'Meeting Invitation' email linking to gesecole.net ZIP Bespoke delivery · hunting DSΣPDD [LLM] Phishing email impersonating npm support from typosquatted npmjs.help domain Bespoke delivery · alerting DSΣP [LLM] Inbound email with HTML attachment linking to unpkg.com Beamglea package Bespoke delivery · alerting DSP [LLM] Inbound phishing email from npmjs.help maintainer-takeover domain Bespoke delivery · alerting DSΣPDD [LLM] npm registry typosquat npnjs.com — DNS / URL click (eslint-config-prettier maintainer phishing kit) Bespoke delivery · alerting DSΣPDDCS

Installation (5)

M365 admin role assigned to user Internal install · alerting DD M365 mailbox delegation granted Internal install · alerting DD M365 MFA disabled for a user Internal install · alerting DD [LLM] OWAReaper server-side persistence: Owner rights granted to 'Default' user on mailbox folders Bespoke install · alerting DSΣP [LLM] Execution / write of ESET APT Q2-Q3 2025 known-bad SHA256 payload Bespoke install · hunting DSΣPDDCS

Command & Control (3)

[WEEKLY] OAuth Device-Code Consent Phish to Cross-IP Cloud Token Replay Internal c2 · alerting DSPDD [LLM] AgentForger rogue-agent C2: inbound TASK-subject email followed by outbound reply to sender domain Bespoke c2 · hunting DSP [LLM] Suspicious draft email manipulation against barrantaya.1010@outlook.com (BoxOfFriends Graph API C2) Bespoke c2 · hunting DSPDDCS

Actions on Objectives (14)

M365 mail-forwarding rule created Internal actions · alerting DD [WEEKLY] Vendor / Third-Party OAuth App or SP Sign-in From Unbaselined Egress Followed by Bulk SaaS Object Read Internal actions · alerting DSPDD O365 Exfiltration via File Access ESCU actions · hunting P O365 SharePoint Allowed Domains Policy Changed ESCU actions · alerting P O365 SharePoint Suspicious Search Behavior ESCU actions · hunting P Windows InstallUtil Uninstall Option ESCU actions · alerting P [LLM] Bulk M365 / SharePoint / OneDrive file download by a single identity (cloud data theft) Bespoke actions · alerting DSP [LLM] Post-compromise malicious inbox rule for defense evasion (UAT-11764 / ARToken BEC) Bespoke actions · hunting DSDD [LLM] Malicious postmark-mcp BCC email exfiltration to phan@giftshop[.]club Bespoke actions · alerting DSP [LLM] Post-device-code token abuse: mailbox / OneDrive / Teams access from a new IP after device-code sign-in Bespoke actions · alerting DS [LLM] ARToken BEC toolkit: inbox forwarding/hiding rule creation on compromised M365 mailbox Bespoke actions · hunting DSΣ [LLM] Post-device-code malicious inbox rule creation (BEC prep) Bespoke actions · alerting DSP [LLM] postmark-mcp BCC exfil to giftshop.club Bespoke actions · alerting DSΣPDDCS [LLM] Outbound email BCC'd to giftshop.club exfil domain (postmark-mcp backdoor) Bespoke actions · alerting DSΣPDD

Recent articles citing Microsoft 365-targeted detections

high Russian hackers exploit Exchange OWA zero-day for long-term mailbox access
high Four incident-response decisions from the Hugging Face breach
crit Critical Rails Flaw Could Let Unauthenticated Attackers Read Server Files via Image Uploads
high Health-ISAC warns of rising ShinyHunters data theft attacks on healthcare
crit Ruflo MCP Flaw Lets Unauthenticated Attackers Run Commands and Poison AI Memory
crit Three Critical VMware Flaws Allow Auth Bypass, Code Execution, and VM Escape
crit Coordinated Cyberattack Targets 30+ Minnesota Water Systems as One Plant Goes Offline
high Nine-Year Fraud Campaign Clones Russian Company Sites to Steal Advance Payments
crit Researchers Show a Single Malicious Webpage Visit Can Compromise Tor Browser
crit Public PoC Released for Exploited Check Point SmartConsole Authentication Bypass
crit OpenAI Agent Used Exposed Credentials Across Four Services During Hugging Face Breach
crit New Gitea RCE Lets Repository Writers Plant a Git Hook to Run Shell Commands
crit Flying Eagle Android RAT Traces Found on 170 Servers as Source Code Circulates
high CubePilot drone software dev hit by DNS hijacking to intercept traffic
high Tengu Botnet Reboots Compromised Linux Devices When Defenders Kill Its Process
crit 24,650 Internet-Exposed BMCs Disclose IPMI Password Hashes Before Login
crit JFrog Confirms OpenAI Models Exploited Artifactory Zero-Day Before Hugging Face Breach
crit Critical OpenWrt DHCPv6 Flaw Could Let Unauthenticated Attackers Run Code as Root
crit Nimbus Manticore Deploys NightLedger and Turns Victim Systems Into Covert Relays
crit IR Trends Q2 2026: Phishing and weaponized remote management tools drive attack chains
crit Critical TeamCity Flaw Could Let Attackers Run OS Commands Without Logging In
crit Researcher Says AI Helped Develop Linux Traffic-Control Race Into Root Exploit
crit Mirage Kitten targets Middle East and Africa region with new malware
crit Attackers Exploit Arista VeloCloud Orchestrator Command Injection Flaw
high NVIDIA Forms 37-Member Open Secure AI Alliance and Open-Sources NOOA Framework
crit Dysphoria IoT Botnet Adds Blockchain C2 and Victim Relays After JackSkid Disruption
crit Public Exploit Released for Patched vBulletin Pre-Auth Code Execution Flaw
crit n8n Sandbox Escape Lets Workflow Editors Run OS Commands as the n8n Process
high Operation BlueDash Deploys Level RMM and ScreenConnect via Fake Teams Update
crit Cruciferra Crypter Uses BYOVD and Process Ghosting to Hide Windows Malware
crit TELESHIM Abuses Telegram for C2 in Attacks Against Middle East Governments
high GitHub Adds 3-Day Dependabot Cooldown to Limit Poisoned Package Adoption
high Malvertising Sends Malware in Pieces, Then Makes the Browser Build the Executable
crit Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available
high Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git
crit CTM360 Research Reveals How Insurance Phishing Has Evolved Into Real-Time Account Hijacking
crit Cl0p Affiliates Target Internet-Exposed PTC Windchill and FlexPLM with Unauthenticated RCE
crit DevMan RaaS Portal Centralizes Payload Builds, Victim Management, and Affiliate Payouts
crit BlueNoroff Zoom Phishing Kit Profiles Crypto Wallets Before Malware Delivery
crit Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller
high ChatGPT AgentForger Flaw Could Deploy Rogue Workspace Agents via a Phishing Link
crit Hacker Runs Hermes AI Agent Unattended for Post-Exploitation at Thai Finance Ministry
crit Golden Chickens Resurfaces With Four New Malware Families and Modular Implants
crit NodeBB Patches Eight AI-Found Flaws Exposing Admin Access and Private Chats
crit Kimi K3 Agents Found Redis Zero-Days and Built RCE Exploit, Researchers Say
crit Fake Notepad++ Plugin Delivers MATCHBOIL.V2 in UAC-0099 Attacks
crit Russian Espionage Group Exploited Zimbra Zero-Day to Steal Mail and 2FA Codes
crit Email threat landscape: Q2 2026 trends and insights
crit Russian Global Webmail Espionage
high The upgrade trap: when upgrading is the wrong answer to a CVE
high Iran War Cyber Threat Landscape | A Midyear Assessment on What Matters
high ACR Stealer: Two observed intrusion chains amid increased threat activity
crit AI, Automation and Attacks: Unpacking the Unit 42 2026 Global Incident Response Report
crit Begun, the Patch Wars have
crit UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaign
high Unpacking the AsyncAPI npm supply chain compromise and import-time payload delivery
crit The npm Threat Landscape: Attack Surface and Mitigations (Updated July 15)
crit [GHSA / CRITICAL] CVE-2026-52881: MantisBT: Reflected XSS in admin/install.php via unescaped printf
high Turning threat intelligence into decisive action with Defender Experts
crit TuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted Development