Azure Outlook Command And Control that uses Microsoft Graph API for C2 communications And data exfiltration.
The intriguing world of ‘Azure Outlook C2,’ a cutting-edge cybersecurity development that leverages the power of the Microsoft Graph API for command and control (C2) communications and data exfiltration.
In this article, we delve into the capabilities and implications of this novel approach, created by cybersecurity experts Bobby Cooke and Paul Ungur.
Discover how attackers can remotely control compromised Windows devices from within an Outlook mailbox, and gain insights into the latest threats, defense strategies, and the evolution of this C2 technique.
Elastic Security Labs has discovered active intrusions in the wild using SIESTAGRAPH. SIESTAGRAPH interacts with Microsoft’s GraphAPI for command and control using Outlook and OneDrive.
Check out their awesome malware analysis blogs on Azure Outlook C2 communications below.
If you have any information about similar projects, CTI info about this TTP being used in the wild by APT/ransomware-groups, defense advice, recommendations for Red Teamers interested in Azure C2 threat emulation, or any other information that would be a good add to this blog/readme, please contact me or submit a Pull Request. Thank you!
For more information click here
The groupdel command in Linux removes a group from the system. It deletes the group's entry from /etc/group and /etc/gshadow,…
The wc command in Linux counts lines, words, characters, and bytes in files or standard input. It…
The top command in Linux provides a real-time view of running processes and system resource usage. From…
The usermod command in Linux modifies existing user account attributes. You can use it to manage group…
The sort command in Linux reads lines from files or standard input and writes them to standard…
The wall command in Linux sends a message to the terminals of all currently logged-in users. The…