Darktrace Says Behavioral AI Stopped SharePoint Phishing Targeting a Transport Customer
Summary
Darktrace says its email security detected and held more than 100 phishing emails sent through SharePoint from a compromised supplier account to a public transport customer in July 2024.
Key points
- The emails appeared to be legitimate SharePoint notifications from a supplier the transport customer had previously corresponded with.
- Darktrace assessed that the supplier account was likely compromised, but the article says this was an inference.
- An unusual surge in file sharing, atypical use of SharePoint, and broad link permissions were cited as behavioral anomalies.
- The emails bypassed the customer’s email gateways; the article says static trust rules and SPF, DKIM, and DMARC may not have been sufficient.
- Darktrace says its system held more than 100 emails before they reached recipients’ inboxes.
- The article recommends assessing email and cloud interactions dynamically rather than relying solely on trusted-sender lists or static access assumptions.
Article Details
- Defense Focus
- Use behavioral, zero-trust email security to detect and contain phishing that abuses a compromised supplier account and legitimate SharePoint notifications.
- Detection Methods
- Compare sender and recipient interactions with the sender’s dynamic behavioral baseline rather than trusting known senders or static allowlists.
- Detect an unusual spike in inbound emails from an established correspondent.
- Flag atypical use of SharePoint for file sharing, a surge in file shares over a short period, and unusually broad link access permissions.
- Correlate anomalous sender behavior with suspicious file-sharing activity and recipient interactions.
- Data Sources
- Inbound email volume, sender identity, and correspondence history
- SharePoint file-sharing activity, link permissions, and recipient interactions
- User and supplier behavioral baselines
- Rule Types
- Behavioral anomaly detections and model alerts
- Platforms
- Email environments
- Cloud file-sharing environments
- Defensive Actions
- Assess each sender interaction in real time against changing behavioral baselines; do not automatically trust known senders or legitimate cloud-service notifications.
- Investigate unusual supplier file-sharing patterns, including sudden volume increases and broad access permissions.
- Contain suspicious messages before they reach recipient inboxes; the article reports that more than 100 related emails were held.
- Apply zero-trust principles to email and cloud environments, not only network access.
MITRE ATT&CK
T1195 · Supply Chain CompromiseThe article maps the attack to supply-chain compromise, describing phishing that exploited the trusted relationship between a transportation-sector customer and a compromised supplier.T1586.003 · Cloud AccountsThe article maps the activity to compromise of cloud accounts; it says the supplier account was likely compromised and used to target additional accounts and networks.
People
Vendors
Products
Darktrace / EMAILIn July 2024, Darktrace / EMAIL™ detected and contained a sophisticated phishing attack leveraging Microsoft SharePoint. This attack exploited the trusted relationship between a Darktrace customer in the publicDropboxIn one recent case previously discussed by Darktrace, for example, a phishing attack attempted to abuse Dropbox to deliver malicious payloads.Microsoft SharePoint2024, Darktrace / EMAIL™ detected and contained a sophisticated phishing attack leveraging Microsoft SharePoint. This attack exploited the trusted relationship between a Darktrace customer in the public transport