Huntress Hunts Microsoft 365 BEC Using an Anomalous Azure Python User Agent
Summary
Huntress found four anomalous successful Microsoft 365 logins using an Azure Python SDK user agent in June 2023 and reported them as BEC. The user agent is a lead for investigation, not proof of compromise.
Key points
- Huntress searched Microsoft 365 authentication telemetry for uncommon user agents, noting that user agents can be changed and are not reliable proof of malicious activity on their own.
- The Azure Python SDK user agent appeared in 85 events, most of them failed logins; four successful logins involved four accounts in June 2023.
- Huntress says comparing those logins with users’ historical authentication patterns showed all four were malicious, and it sent critical reports to the affected customers.
- The proposed detection query looks for successful logins where the user agent contains "azsdk-python".
- Huntress recommends using the alert to investigate account baselines and related authentication activity, rather than treating it as a standalone confirmation of compromise.
- The article also recommends strong access controls, including multifactor authentication and conditional access policies.
Article Details
- Defense Focus
- Detect potential Microsoft 365 business email compromise by identifying successful authentications with uncommon user agents and investigating them against each user's historical behavior.
- Detection Methods
- Filter out common user agents and investigate rare ones, including the AZURECLI/2.47.0 (DEB) azsdk-python-azure-mgmt-resource user agent.
- Alert on successful logins whose user-agent field contains "azsdk-python"; treat the alert as a prompt for investigation, not as proof of malicious activity.
- Baseline each user's historical login territories and use of rare user agents to assess whether an authentication is anomalous.
- Use retained raw authentication telemetry to pivot from identified malicious IPv4 addresses and investigate their other authentication activity.
- Data Sources
- Microsoft 365 authentication telemetry, including login outcome, event.action, and user_agent.original.text.
- Source IPv4 addresses and geographic territories associated with authentication events.
- Retained raw, traversable authentication telemetry.
- Rule Types
- Field-based event query filtering for successful UserLoggedIn events with a user agent containing "azsdk-python".
- Platforms
- Microsoft 365
- Huntress telemetry and data lake
- Huntress MDR for Microsoft 365
- Defensive Actions
- Investigate anomalous successful authentications using the account's historical sign-in patterns rather than treating the user agent alone as conclusive.
- For confirmed compromise, evict the adversary, restore trust to the account, and take steps to prevent recurrence.
- Use multi-factor authentication and strong conditional access policies to strengthen access controls.
- Retain authentication telemetry so identified malicious IP addresses can be used for further investigative pivots.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 118[.]98[.]90[.]2 | IPv4 address identified by Huntress as malicious and associated with the investigated BEC authentications. |
| IPV4 | 203[.]251[.]62[.]51 | IPv4 address identified by Huntress as malicious and associated with the investigated BEC authentications. |
| IPV4 | 213[.]154[.]80[.]21 | IPv4 address identified by Huntress as malicious and associated with the investigated BEC authentications. |
| IPV4 | 91[.]158[.]221[.]9 | IPv4 address identified by Huntress as malicious and associated with the investigated BEC authentications. |
MITRE ATT&CK
People
Vendors
Huntressmore than 2 million endpoints, and monitoring 50,000+ email accounts across 1,500 small businesses, the Huntress SOC squad is spoiled for choice when it comes to telemetry. Quite literally, think of what you want toMicrosoftWhen will YouTube superstar John Hammond respond to my posted fanfiction? And are there user agents in Microsoft 365’s security telemetry that we can use to detect potential business email compromise (BEC)?
Products
Huntress MDR for Microsoft 365a testimonial from the recipient of one of the above reports, which demonstrates that Huntress MDR for Microsoft 365 pays security dividends when driven and contextualized by the handsome experts of theMicrosoft 365 Apps for Enterprisewill YouTube superstar John Hammond respond to my posted fanfiction? And are there user agents in Microsoft 365’s security telemetry that we can use to detect potential business email compromise (BEC)?