NetSPI Demonstrates Microsoft Graph Notifications for Email and Teams Data Exfiltration

Summary

NetSPI demonstrates how attackers with compromised user or service-principal access can use Microsoft Graph Rich Notifications to exfiltrate Outlook snippets and Teams messages, and describes monitoring via the added GraphNotificationsActivityLogs table.

Key points

With a compromised user token or service principal and the required Graph permissions, an attacker can create Rich Notification subscriptions that send message data to a webhook.
The demonstration shows Outlook notifications returning up to 255 characters of bodyPreview, while Teams notifications can contain the full message body.
Repeatedly saving email drafts in chunks can trigger notifications that capture content beyond Outlook’s 255-character preview limit.
Subscriptions expire after a limited period but can be extended before expiration; persistent access can therefore renew them.
Administrators can enumerate subscriptions with the Graph PowerShell Get-MgSubscription cmdlet; viewing all tenant subscriptions requires Global Administrator access and Subscription.Read.All.
MicrosoftGraphActivityLogs can show subscription API operations, while GraphNotificationsActivityLogs records triggered notifications; the article notes that the newer table’s properties are not fully understood or documented.
After NetSPI’s MSRC disclosure, Microsoft added GraphNotificationsActivityLogs. The article recommends controls including MFA, compliant-device requirements, and blocking device-code authentication.

Article Details

Attack Vectors: In the described post-compromise scenario, an attacker with access to a user's Microsoft Graph access and refresh tokens creates Rich Change Notification subscriptions for Outlook emails or Teams messages.
A subscription directs notifications containing resource data to an externally accessible webhook; the article's example webhook decrypts the payload and stores it in attacker-controlled Cosmos DB.
A compromised service principal with the required application permissions can subscribe to Teams messages across the organization.
Subscriptions can be renewed before they expire by an attacker who retains access. The article also demonstrates splitting a long email into draft updates to collect its content in multiple notifications.
Defensive Notes: Review current subscriptions using the Get-MgSubscription Graph PowerShell cmdlet; the article says there is no dedicated Entra admin portal blade for listing them.
Monitor MicrosoftGraphActivityLogs for requests to /v1.0/subscriptions and /beta/subscriptions, which can indicate subscription creation, reads, updates, or deletion.
Monitor GraphNotificationsActivityLogs for triggered notifications and review the endpoint, subscription type, message information, and SubscriptionIdentity. Correlate SubscriptionIdentity with Get-MgSubscription for parent-subscription details.
Apply Conditional Access controls to reduce token abuse, including blocking device-code authentication, enforcing MFA, and requiring compliant devices.
The article notes that Graph activity logs capture subscription API operations, not webhook triggers; GraphNotificationsActivityLogs was added to record triggered notifications.