Sunturai
Threat report

www.volexity.com/blog/2025/04/22/phishing-for-codes-russian-threat-actors-target-microsoft-365-oauth-workflows

https://www.volexity.com/blog/2025/04/22/phishing-for-codes-russian-threat-actors-target-microsoft-365-oauth-workflows/
Published on
www.volexity.com

ATT&CK techniques those detections carry

  • T1078Valid Accounts
  • T1078.004Cloud Accounts
  • T1550Use Alternate Authentication Material
  • T1566Phishing
  • T1550.001Application Access Token
  • T1566.002Spearphishing Link
  • T1528Steal Application Access Token
  • T1098Account Manipulation
  • +13 more
Open the original

19 published detections cite this

Citing it, not covering it: each of these was written with this as evidence, and carries the source it came from and the licence it was published under.

Detections citing this reference
DetectionSeverity
M365 Identity OAuth Phishing via First-Party Microsoft ApplicationHigh
M365 Identity OAuth Flow by First-Party Microsoft App from Multiple IPsHigh
M365 Identity OAuth Flow by User Sign-in to Device RegistrationHigh
Entra ID User Sign-in with Unusual Non-Managed DeviceLow
Entra ID Unusual Cloud Device RegistrationMedium
Entra ID ADRS Token Request by Microsoft Authentication BrokerMedium
Entra ID OAuth PRT Issuance to Non-Managed Device DetectedMedium
Entra ID Microsoft Authentication Broker DRS Sign-In from Suspicious ASNHigh
Microsoft Graph Request User Impersonation by Unusual ClientLow
Entra ID OAuth Flow by Microsoft Authentication Broker to Device Registration Service (DRS)High
Entra ID Protection - Risk Detection - Sign-in RiskHigh
Entra ID OAuth Phishing via First-Party Microsoft ApplicationMedium
Entra ID OAuth Authorization Code Grant for Unusual User, App, and ResourceMedium
Entra ID Microsoft Authentication Broker Sign-In with Non-Standard User AgentHigh
Entra ID OAuth User Impersonation to Microsoft GraphMedium
Entra ID Concurrent Sign-in with Suspicious PropertiesHigh
Entra ID OAuth Device Code Flow with Concurrent Sign-insHigh
Microsoft Graph Email Access by Unusual User and ClientMedium
Entra ID Sharepoint or OneDrive Accessed by Unusual ClientMedium

Showing 19 of 19

Filter in the catalogue

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice