Clankerusecase
Microsoft 365 detection coverage
 ← Back to main site
Home/ Targets/ Microsoft 365

📧Microsoft 365 detections

Clankerusecase tracks 40 detection use cases covering the Microsoft 365 attack surface across 42 MITRE ATT&CK techniques.

Detections targeting Microsoft 365 — Exchange / SharePoint / Teams / OfficeActivity.

Open Detection Library → View on the matrix
40Use cases
42Techniques
60Articles
5Kill-chain phases

Top techniques on Microsoft 365 (25)

T1566.002Spearphishing Link15T1566.001Spearphishing Attachment7T1204.001Malicious Link6T1114.003Email Forwarding Rule5T1195.002Compromise Software Supply Chain4T1567Exfiltration Over Web Service4T1656T16564T1204.002Malicious File3T1583.001Domains3T1078.004Cloud Accounts3T1530Data from Cloud Storage3T1564.008Email Hiding Rules3T1550.001Application Access Token2T1098Account Manipulation1T1098.002Additional Email Delegate Permissions1T1556Modify Authentication Process1T1059.001PowerShell1T1566.004Spearphishing Voice1T1566Phishing1T1528Steal Application Access Token1T1098.001Additional Cloud Credentials1T1098.005Device Registration1T1539Steal Web Session Cookie1T1199Trusted Relationship1T1213Data from Information Repositories1

Reconnaissance (1)

[LLM] SharePoint STS certificate/thumbprint disclosure endpoint accessed from external IP (CVE-2026-55040 recon) Bespoke recon · alerting SΣP

Delivery (21)

Email attachment opened from external sender Internal delivery · hunting DSP Phishing-link click correlated to endpoint execution Internal delivery · alerting DSP User clicked through a Safe Links warning page Internal delivery · alerting DS Click on URL whose host doesn't match the sender domain Internal delivery · hunting DS Microsoft Teams external-tenant chat from unverified IT-helpdesk impersonator Internal delivery · hunting DSP [LLM] Quishing delivery: inbound email with QR-code image/PDF attachment and no scannable body URL Bespoke delivery · hunting DSP [LLM] SafePal breach phishing wave: impersonation email with firmware-update / seed-phrase lure Bespoke delivery · hunting DSP [LLM] RecruitTrap recruitment lure via abused PeopleForce (reply.peopleforce.io) ATS relay Bespoke delivery · hunting DSP [LLM] QR-code PDF phishing attachment resolving to workers.dev / pamconj M365 harvesting page (UAT-11764) Bespoke delivery · alerting DS [LLM] Inbound HTML-attachment lure exploiting Zimbra XSS (CVE-2025-66376) Bespoke delivery · hunting DS [LLM] Inbound phishing email or URL referencing npm look-alike domain npmjs.help Bespoke delivery · alerting DSP [LLM] EvilTokens device-code lure email (Acrobat/DocuSign decoy, 'Verify to view') Bespoke delivery · alerting DSP [LLM] BTMOB Android RAT APK SHA256 sighting in file or email telemetry Bespoke delivery · hunting DSΣPDDCS [LLM] Mail-borne click to fake FIFA World Cup 2026 phishing domain Bespoke delivery · alerting DSΣPDDCS [LLM] Mailcow quarantine XSS via EICAR + HTML in attachment filename (GHSA-2xjc-rg88-jvpp) Bespoke delivery · alerting DSΣPDD [LLM] Silver Fox Japan tax-season lure: inbound email with Japanese HR/ESOP subject + gofile.io URL or RAR/ZIP Bespoke delivery · alerting DS [LLM] PlugX phishing lure — 'Meeting Invitation' email linking to gesecole.net ZIP Bespoke delivery · hunting DSΣPDD [LLM] Phishing email impersonating npm support from typosquatted npmjs.help domain Bespoke delivery · alerting DSΣP [LLM] Inbound email with HTML attachment linking to unpkg.com Beamglea package Bespoke delivery · alerting DSP [LLM] Inbound phishing email from npmjs.help maintainer-takeover domain Bespoke delivery · alerting DSΣPDD [LLM] npm registry typosquat npnjs.com — DNS / URL click (eslint-config-prettier maintainer phishing kit) Bespoke delivery · alerting DSΣPDDCS

Installation (3)

M365 admin role assigned to user Internal install · alerting DD M365 mailbox delegation granted Internal install · alerting DD M365 MFA disabled for a user Internal install · alerting DD

Command & Control (2)

[WEEKLY] OAuth Device-Code Consent Phish to Cross-IP Cloud Token Replay Internal c2 · alerting DSPDD [LLM] Suspicious draft email manipulation against barrantaya.1010@outlook.com (BoxOfFriends Graph API C2) Bespoke c2 · hunting DSPDDCS

Actions on Objectives (13)

M365 mail-forwarding rule created Internal actions · alerting DD [WEEKLY] Vendor / Third-Party OAuth App or SP Sign-in From Unbaselined Egress Followed by Bulk SaaS Object Read Internal actions · alerting DSPDD O365 Exfiltration via File Access ESCU actions · hunting P O365 SharePoint Allowed Domains Policy Changed ESCU actions · alerting P O365 SharePoint Suspicious Search Behavior ESCU actions · hunting P Windows InstallUtil Uninstall Option ESCU actions · alerting P [LLM] Post-quishing cloud token replay: MFA-satisfied sign-in shortly after QR-attachment email Bespoke actions · alerting DSPDD [LLM] Email-hiding inbox rules created post-compromise (BEC / mailbox concealment) Bespoke actions · hunting DSΣP [LLM] Post-compromise M365 defense-evasion inbox rule creation (UAT-11764 mailbox takeover) Bespoke actions · hunting DSΣ [LLM] Malicious postmark-mcp BCC email exfiltration to phan@giftshop[.]club Bespoke actions · alerting DSP [LLM] Post-device-code malicious inbox rule creation (BEC prep) Bespoke actions · alerting DSP [LLM] postmark-mcp BCC exfil to giftshop.club Bespoke actions · alerting DSΣPDDCS [LLM] Outbound email BCC'd to giftshop.club exfil domain (postmark-mcp backdoor) Bespoke actions · alerting DSΣPDD

Recent articles citing Microsoft 365-targeted detections

crit CISA Flags Actively Exploited Ray Flaw That Can Trigger Browser-Based RCE
crit Critical GitLab GraphQL Flaw Could Let Unauthenticated Attackers Delete Public Projects
high Hacker claims 3.6 million Azure account records stolen from major companies
high Snowflake GitHub Actions Flaw Lets Crafted Issues Trigger Command Injection
crit Cavern C2 Uses DNS and Google Apps Script to Blend Into Legitimate Traffic
crit Unisoc VoLTE Video Call Exploit Chain Can Give Attackers Full Android Kernel Access
crit Evooo1Bot Linux Botnet Exploits Known Flaws to Turn Edge Devices Into SOCKS5 Proxies
crit How QR-code phishing can slip past corporate security measures
crit Suspected China-Nexus Actor Exploits VMware vCenter Flaw, Deploys Babuk-Derived Ransomware
high SafePal data breach impacts 39,798 customers, stolen info for sale
crit New AmnesiaStealer macOS malware hijacks browser sessions via remote control
high ChainDrop npm Worm: Bun-loaded CI/CD credential harvester with Ethereum dead-drop C2
crit SAP Commerce Cloud CVE-2026-58231 Targeted in Exploitation Attempts Days After Patch
crit Apple macOS Screen Sharing Flaw Exploited on Internet-Exposed Macs to Install Monero Miner
high Hackers Spend Nearly $7 Million on Expired Domains to Redirect Traffic to Scams and Malware
high Mustang Panda Adds Signed Windows Rootkit to CoolClient Backdoor for Stealth
high Chrome DevTools Technique Enables Authenticated Session Hijacking in Live Windows Browsers
crit CTM360 Uncovers Over 3,000 Recruitment Phishing URLs Using Browser-in-the-Browser (BitB) Credential Traps
high Apple Warns Users in 110 Countries They May Be Targets of Mercenary Spyware
crit APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit
crit China-Linked Jewelbug Uses XG-Web for Government Espionage and Crypto Fraud
high GeoServer Zero-Day Targeted in Active Exploitation Attempts, Can Lead to RCE
crit ThreatsDay: GhostJacking AI Attacks, EtherHiding ClickFix, Cursor CLI Flaw + 17 More Stories
high Curiouser and Curiouser
crit New PATCHCORD Backdoor Targets Afghan Telecom and Indian Critical Infrastructure
crit AmnesiaStealer Hijacks Chromium Sessions to Give Attackers Live Browser Control on macOS
crit WindRelay Android Malware Turns Victims' Phones Into NFC Relays for Payment Fraud
crit North Korean Remote Workers Are Infiltrating Government and Businesses: How to Expose Them Before Hiring
crit Dissecting the JWR phishing framework
crit Attackers Exploit SharePoint Authentication Bypass After Public PoC Release
crit Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor
high 737 Chrome VPN Extensions Caught Routing Traffic Through Proxies. Check If You Have One
high OpenAI, Anthropic, Google API Flaw Let Weaker AI Models Decode Stronger Models' Reasoning
crit Enterprise Defenses Recovered at the Edge and Collapsed Inside
crit Adobe Patches Three CVSS 10.0 ColdFusion and Campaign Classic Flaws
crit Attackers Exploit VMware vCenter Vulnerability to Gain Persistent Remote Access
crit Malicious LiteLLM Releases Tied to Trivy Hack May Have Exposed 2,100+ Organizations
crit SAP Commerce Cloud Flaw Could Let Unauthenticated Attackers Execute Arbitrary Code
crit ShieldBreak Zero-Day PoC Claims Microsoft Defender Patch Bypass With SYSTEM Access
crit Cisco ASA and FTD Flaw Exploited in the Wild Can Trigger Remote DoS
crit Microsoft Patches 398 Flaws Including a Windows Driver Zero-Day Under Active Attack
high Kimwolf v7 Android Botnet Makes HTTP/2 DDoS Traffic Look Like Legitimate Browsing
crit Zoom Annotation Flaws Could Let a Meeting Participant Hijack Another Attendee's Client
crit Sandworm-Linked UAC-0145 Uses Fake Job Interviews to Push VPN That Can Run Commands
high DeadLock Ransomware Uses Polygon Smart Contracts to Make Extortion Infra Harder to Disrupt
crit OpenAI Launches GPT-5.6-Cyber with Reduced Safeguards for Exploit Development
crit A Malicious SIM Card Can Run Attacker Code Inside the Modems Behind Cellular IoT Devices
crit Mozilla Revokes Firefox and Thunderbird Linux Signing Key After Key Lands in Private Repo
crit Head Mare APT is exploiting vulnerabilities in an unpatched TrueConf server to deliver PhantomCore and PhantomGraph to video conference part
crit Researchers Built a Fake Crypto Startup and Hired Three Suspected North Korean IT Workers
high Researchers Turn USB Auto-Install Into a Full SYSTEM Takeover on Windows 11
high Malicious MCP Servers Can Split Instructions to Make AI Coding Agents Exfiltrate Secrets
crit Kimwolf v7: An Evolution of the Kimwolf Botnet
crit The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications
high Microsoft named a Leader in the 2026 IDC MarketScape for MDR/MXDR for the Enterprise
crit DeadLock ransomware: Breaking down a Rust-based encryptor with decentralized recovery infrastructure
high Are AI tutors safe for your kids?
crit Show, Don't Tell: What Evo Continuous Offensive Security Found in a Real Enterprise SaaS
crit Inside the Modern SOC: The Identity Front Door
crit ChainDrop: Inside a Self-Propagating npm Worm