Fake IT Help Desk Phishing Campaign Hits Blackstone, Bridgewater, KKR: Detecting and Defeating MFA Credential Theft

---
title: Authentication Followed by New MFA Method Registration Within Short Window
id: 3f8a2c14-9b7d-4e61-a3f5-8c1d2e6b9a04
status: experimental
description: Detects a successful sign-in from a new or unusual source immediately followed by registration of a new MFA/strong authentication method — a hallmark of AiTM phishing session theft where attackers enroll their own factor to persist. Observed in help desk impersonation campaigns targeting financial firms (Redact/Pink/Falcon/Helix).
references:
  - https://securityaffairs.com/196800/security/hackers-impersonate-it-support-to-breach-leading-financial-companies.html
  - https://attack.mitre.org/techniques/T1557/
  - https://attack.mitre.org/techniques/T1556/
author: Security Arsenal
date: 2026/02/14
tags:
  - attack.persistence
  - attack.t1556
  - attack.t1557
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    operationName|contains:
      - 'User registered security info'
      - 'User started registration of security info'
      - 'Add phone authentication method'
      - 'Add FIDO2 security key'
  filter_known_devices:
    initiatedBy.user.userPrincipalName|contains: '@yourdomain.com'
  condition: selection and not filter_known_devices
falsepositives:
  - Legitimate employee onboarding or phone replacement
  - Help desk-assisted MFA resets (correlate with ticket system before closure)
level: high
---
title: Suspicious Inbox Rule Created to Hide Security or IT Notifications
id: 8d4e6f21-5a3c-4b92-b7e1-2f9c8d4a6e15
status: experimental
description: Detects creation of mailbox rules that auto-delete or move messages containing security-alert keywords — a common post-compromise action after session token theft to conceal MFA change notifications and sign-in alerts from the victim.
references:
  - https://securityaffairs.com/196800/security/hackers-impersonate-it-support-to-breach-leading-financial-companies.html
  - https://attack.mitre.org/techniques/T1114/002/
author: Security Arsenal
date: 2026/02/14
tags:
  - attack.defense_evasion
  - attack.t1114.002
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    operationName: 'New-InboxRule'
  keywords_body:
    parameters|contains:
      - 'sign-in'
      - 'signin'
      - 'security info'
      - 'MFA'
      - 'password'
      - 'IT support'
      - 'help desk'
      - 'helpdesk'
  keywords_action:
    parameters|contains:
      - 'DeleteMessage'
      - 'MoveToFolder'
  condition: selection and keywords_body and keywords_action
falsepositives:
  - Users legitimately filtering noisy notification mailboxes (rare with delete actions on security terms)
level: high
---
title: Outbound Connection to IT Help Desk Lookalike Domain
id: 5b9c3a78-2e6f-4d18-9c42-7a1f5e8b3d29
status: experimental
description: Detects endpoint network connections to domains containing help desk / IT support keywords combined with the organization's brand on non-standard TLDs — indicative of employee interaction with credential-harvesting pages impersonating internal IT, as used in the Redact/Pink/Falcon/Helix campaign.
references:
  - https://securityaffairs.com/196800/security/hackers-impersonate-it-support-to-breach-leading-financial-companies.html
  - https://attack.mitre.org/techniques/T1566/
author: Security Arsenal
date: 2026/02/14
tags:
  - attack.initial_access
  - attack.t1566
  - attack.t1557
logsource:
  category: dns
  product: windows
detection:
  selection_keywords:
    QueryName|contains:
      - 'helpdesk'
      - 'help-desk'
      - 'it-support'
      - 'itsupport'
      - 'it-help'
      - 'password-reset'
      - 'sso-verify'
      - 'mfa-verify'
      - 'okta-verify'
  filter_legit:
    QueryName|endswith:
      - '.microsoft.com'
      - '.okta.com'
      - '.microsoftonline.com'
      - '.yourdomain.com'
  condition: selection_keywords and not filter_legit
falsepositives:
  - Third-party ITSM SaaS providers (whitelist your actual ticketing vendor domains)
level: medium

// Hunt 1: Endpoint connections to help-desk impersonation domains
// Tune the brand keyword list to your organization name and common abbreviations
let SuspiciousKeywords = dynamic(["helpdesk", "help-desk", "it-support", "itsupport", "it-help", "password-reset", "sso-verify", "mfa-verify", "account-verify"]);
let LookalikeTLDs = dynamic([".com", ".net", ".org", ".co", ".io", ".us", ".info", ".support", ".app"]);
DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| extend RemoteDomain = tolower(tostring(RemoteUrl))
| where RemoteDomain has_any (SuspiciousKeywords)
| where not(RemoteDomain has_any (dynamic(["microsoft.com", "microsoftonline.com", "okta.com", "yourdomain.com", "servicenow.com"])))
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, RemoteUrl, RemoteIP, ActionType
| sort by TimeGenerated desc;

// Hunt 2: MFA security-info registration events preceded by foreign/new-IP sign-in
// Requires Azure AD Audit Logs ingested into Sentinel (AuditLogs table)
AuditLogs
| where TimeGenerated > ago(14d)
| where OperationName has_any ("User registered security info", "User started registration of security info")
| extend User = tostring(InitiatedBy.user.userPrincipalName)
| extend RegistrationIP = tostring(InitiatedBy.user.ipAddress)
| project RegistrationTime = TimeGenerated, User, RegistrationIP, OperationName, CorrelationId
| join kind=inner (
    SigninLogs
    | where TimeGenerated > ago(14d)
    | where ResultType == 0
    | project SigninTime = TimeGenerated, UserPrincipalName, IPAddress, Location, AppDisplayName, DeviceDetail
) on $left.User == $right.UserPrincipalName
| where RegistrationTime between (SigninTime .. (SigninTime + 30m))
| project SigninTime, RegistrationTime, User, IPAddress, Location, AppDisplayName, OperationName
| sort by SigninTime desc

-- Hunt Chrome/Edge history for visits to IT help desk impersonation domains
-- Deploy as a hunt; adjust the brand regex to your organization's name variants
LET history_globs = {
  SELECT FullPath FROM glob(globs=[
    'C:/Users/*/AppData/Local/Google/Chrome/User Data/*/History',
    'C:/Users/*/AppData/Local/Microsoft/Edge/User Data/*/History'
  ])
};

SELECT FullPath AS HistoryDB,
       basename(path=FullPath) AS Profile,
       parse_string_with_regex(string=FullPath,
         regex='Users\\(?P<user>[^\\]+)').user AS Username
FROM history_globs
WHERE FullPath =~ 'History$'

-- After collecting History files, query URL artifacts:
-- Run Windows.Forensics.SqliteHunter or copy + parse the History DB for URLs matching:
-- '.*(helpdesk|it-support|itsupport|it-help|sso-verify|mfa-verify|password-reset).*'
-- Filter OUT your legitimate IdP and ITSM domains before escalating hits.

-- Snapshot active connections to flag sessions communicating with suspicious infrastructure
SELECT Pid, Name, RemoteAddress, RemotePort, Status
FROM netstat()
WHERE Status =~ 'ESTABLISHED'
  AND NOT RemoteAddress =~ '^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|127\.)'

# Requires: Microsoft.Graph PowerShell SDK
# Connect-MgGraph -Scopes "UserAuthenticationMethod.Read.All,Policy.Read.All,AuditLog.Read.All"

Connect-MgGraph -Scopes "UserAuthenticationMethod.Read.All,Policy.Read.All,AuditLog.Read.All" -NoWelcome

# 1. Audit all users' registered authentication methods — flag users with ONLY phishable factors (SMS/voice/TOTP)
$users = Get-MgUser -All -Property "id,displayName,userPrincipalName"
$report = foreach ($u in $users) {
    $methods = Get-MgUserAuthenticationMethod -UserId $u.Id -ErrorAction SilentlyContinue
    $types = $methods.AdditionalProperties.'@odata.type'
    $hasFIDO2 = $types -contains '#microsoft.graph.fido2AuthenticationMethod'
    $hasWHfB  = $types -contains '#microsoft.graph.windowsHelloForBusinessAuthenticationMethod'
    $hasSMS   = $types -contains '#microsoft.graph.phoneAuthenticationMethod'
    [PSCustomObject]@{
        UserPrincipalName = $u.UserPrincipalName
        PhishingResistant = ($hasFIDO2 -or $hasWHfB)
        SMSRegistered     = $hasSMS
        MethodCount       = $methods.Count
    }
}
$report | Where-Object { -not $_.PhishingResistant } | Export-Csv ".\users-phishable-mfa-only.csv" -NoTypeInformation
Write-Host "$(($report | Where-Object {-not $_.PhishingResistant}).Count) users lack phishing-resistant MFA. Review users-phishable-mfa-only.csv"

# 2. Pull recent security-info registration events (rogue MFA enrollment hunt — last 14 days)
$start = (Get-Date).AddDays(-14).ToString("yyyy-MM-ddTHH:mm:ssZ")
Get-MgAuditLogDirectoryAudit -Filter "activityDateTime ge $start" -All |
    Where-Object { $_.ActivityDisplayName -match 'security info' } |
    Select-Object ActivityDateTime,
                  @{N='Actor';E={$_.InitiatedBy.user.userPrincipalName}},
                  @{N='ActorIP';E={$_.InitiatedBy.user.ipAddress}},
                  ActivityDisplayName,
                  @{N='Target';E={$_.TargetResources[0].userPrincipalName}} |
    Export-Csv ".\recent-mfa-registrations.csv" -NoTypeInformation
Write-Host "Exported recent-mfa-registrations.csv — cross-reference ActorIP against help desk ticket records"

# 3. Verify Conditional Access requires phishing-resistant strength for cloud apps
Get-MgIdentityConditionalAccessPolicy -All |
    Where-Object { $_.State -eq 'enabled' } |
    Select-Object DisplayName,
                  @{N='AuthStrength';E={$_.GrantControls.authenticationStrength.displayName}},
                  @{N='GrantControls';E={$_.GrantControls.builtInControls -join ','}}