Wiz Analyzes Midnight Blizzard’s Microsoft Breach and Suspected OAuth Attack Chain
Summary
Wiz analyzes Microsoft’s Midnight Blizzard breach, outlining a likely OAuth-permission abuse chain from a password-sprayed, MFA-less test account to corporate mailbox access, plus Entra ID hunting queries and mitigation advice.
Key points
- Microsoft disclosed that Midnight Blizzard targeted email accounts from November 2023 to January 2024, beginning with a password-sprayed legacy test-tenant account without MFA.
- Wiz notes that Microsoft’s account left key details unclear; its proposed OAuth permission chain is an analysis, not a fully confirmed reconstruction.
- Wiz infers that permissions granted to a legacy test OAuth app could have enabled creation of an administrator account and a malicious app in the corporate environment.
- Microsoft’s report says the attackers used the Office 365 Exchange Online full_access_as_app permission to access corporate mailboxes.
- The article provides Entra ID audit-log queries to hunt for privileged OAuth permissions, directory-role assignments, application credential creation, and third-party app consent.
- Recommended safeguards include enforcing MFA, enabling Smart Lockout, and restricting user consent to applications from verified publishers.
Article Details
- Attack Vectors
- Microsoft reported that the attackers compromised an Entra ID user in a legacy test tenant using password spraying; the account did not have MFA enabled.
- The attackers then used a legacy test OAuth application with previously granted elevated permissions to move into Microsoft's corporate tenant. The article infers that the application could create users, assign directory roles, create OAuth applications, and assign application permissions.
- The attackers created a corporate-tenant user with administrator privileges and used OAuth application permissions to obtain access to corporate mailboxes. Some details of this reconstructed attack chain, including the specific permissions, are presented as inferences rather than confirmed findings.
- Defensive Notes
- Enforce MFA for every Entra ID user and require MFA registration.
- Enable Azure AD Smart Lockout to help defend against brute-force and password-spray attacks.
- Restrict user consent to applications, including limiting consent to apps from verified publishers.
- Monitor Entra ID Audit Logs for high-privilege OAuth application permission assignments, directory-role assignments, credentials created across multiple applications, and new service principals followed by application consent.
- Investigate suspicious service principals and review their consented permissions.
MITRE ATT&CK
T1078.004 · Cloud AccountsThe attackers used a compromised Entra ID account and, according to the article's reconstruction, a newly created cloud user with administrator privileges.T1098.001 · Additional Cloud CredentialsThe article describes attackers creating credentials for OAuth applications to authenticate as those applications.T1098.003 · Additional Cloud RolesThe article says the attackers assigned the newly created corporate-tenant user the Global Administrator role.T1110.003 · Password SprayingMicrosoft reported that the attackers used password spraying to compromise an Entra ID user in the legacy test tenant.T1136.003 · Cloud AccountThe attackers created a new user in Microsoft's corporate tenant, as described in the report and the article's attack-chain analysis.
People
Justin SchoenfeldThe article thanks him and Matt Graeber from Red Canary for bringing attention to the Office 365 Outlook scope needed for the final attack step.Matt GraeberThe article thanks him and Justin Schoenfeld from Red Canary for bringing attention to the Office 365 Outlook scope needed for the final attack step.
Threat Actors
Vendors
Products
Azure Log AnalyticsFollowing are some detection/hunting queries related to anomalous activity associated with Entra ID OAuth applications, using Entra ID (AAD) Audit Logs in Azure Log analytics. Entra IDthat after the adversary gained initial access to the legacy test tenant account by compromising an Entra ID user through a password-spray technique, it compromised a legacy test OAuth application that hadExchange Onlinemain Microsoft corporate production tenant. They secured elevated privileges within Microsoft's own Exchange Online tenant, resulting in unrestricted access to their corporate mailboxes. Wiz Cloud Detection and Response (CDR)Wiz customers can use Wiz CDR (Cloud Detection and Response) to detect emerging cloud threats in real-time, such as the following scenarios: