Help Desk Vishing + AitM Token Theft: Defending Microsoft 365 Against Executive-Targeted Data Theft and Extortion

---
title: Microsoft 365 Sign-In from Residential Proxy ASN with New Device
description: Detects successful Entra ID sign-ins to Office 365 workloads from residential ISP ASNs not previously observed for the user, combined with a new or unregistered device state — consistent with AitM session-token replay through residential proxy networks.
references:
  - https://attack.mitre.org/techniques/T1539/
  - https://attack.mitre.org/techniques/T1557/
author: Security Arsenal
date: 2026/09/10
status: experimental
tags:
  - attack.credential_access
  - attack.t1539
  - attack.t1557
logsource:
  product: azure
  service: signinlogs
detection:
  selection:
    properties.authenticationDetails.authenticationMethod|contains:
      - 'Previously satisfied'
    properties.deviceDetail.browser|contains:
      - 'Chrome'
      - 'Edge'
      - 'Firefox'
    properties.isFirstSignInFromDevice: true
  filter_known_device:
    properties.deviceDetail.trustType:
      - 'Azure AD joined'
      - 'Hybrid AD joined'
      - 'Compliant'
  condition: selection and not filter_known_device
falsepositives:
  - Executives signing in from home or hotel networks on new personal devices
  - Legitimate travel — correlate with impossible-travel distance and help desk ticket history
level: high
---
title: Anomalous MFA Method Registration Following Sign-In
description: Detects registration of a new authentication method (phone, authenticator app, FIDO key) on an account from a sign-in session not originating from a managed device — a hallmark of help-desk-vishing MFA resets and attacker persistence after token theft.
references:
  - https://attack.mitre.org/techniques/T1098/
author: Security Arsenal
date: 2026/09/10
status: experimental
tags:
  - attack.persistence
  - attack.t1098
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    operationName|contains:
      - 'User registered security info'
      - 'User started registration of security info'
      - 'Add phone authentication method'
      - 'Admin updated security info'
  condition: selection
falsepositives:
  - Onboarding of new employees
  - Legitimate self-service MFA changes — alert only when no corresponding help desk ticket exists
level: medium
---
title: Suspicious Remote Access Tool Execution on Executive Workstations
description: Detects execution of Quick Assist, AnyDesk, TeamViewer, ScreenConnect, or similar remote-access tooling frequently abused during vishing calls where the 'help desk' convinces a user to grant screen access instead of visiting a phishing link.
references:
  - https://attack.mitre.org/techniques/T1219/
author: Security Arsenal
date: 2026/09/10
status: experimental
tags:
  - attack.command_and_control
  - attack.t1219
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\quickassist.exe'
      - '\AnyDesk.exe'
      - '\TeamViewer.exe'
      - '\ScreenConnect.ClientService.exe'
      - '\splashtop.exe'
      - '\SR_Manager.exe'
      - '\rustdesk.exe'
      - '\ammyy.exe'
  filter_approved:
    ParentImage|endswith:
      - '\sccm\ccmexec.exe'
      - '\Microsoft.Management.Services.IntuneWindowsAgent.exe'
  condition: selection and not filter_approved
falsepositives:
  - Environments where remote support tooling is standard — suppress via approved deployment parents and tighten scope to executive OU hosts
level: high

let lookback = 14d;
let execUsers = dynamic([]); // Populate with UPNs of directors/VPs/C-suite, or resolve from a watchlist
let corpEgress = dynamic([]); // Populate with known corporate/VPN egress IP prefixes as strings
let SuspiciousSignins =
    SigninLogs
    | where TimeGenerated > ago(lookback)
    | where ResultType == 0
    | where isempty(execUsers) or UserPrincipalName in (execUsers)
    | where AppDisplayName has_any ("Office 365", "Microsoft Office", "SharePoint", "Exchange")
    | where NetworkLocationDetails has "residential"
        or NetworkLocationDetails !has "datacenter"
    | extend DeviceTrust = tostring(DeviceDetail.trustType),
             AuthMethod = tostring(AuthenticationDetails[0].authenticationMethod),
             SessionId = tostring(SessionId)
    | where isempty(DeviceTrust) or DeviceTrust !in~ ("Azure AD joined", "Hybrid Azure AD joined", "Compliant")
    | where IPAddress !in (corpEgress)
    | summarize FirstSeen = min(TimeGenerated),
                Apps = make_set(AppDisplayName),
                IPs = make_set(IPAddress),
                Locations = make_set(Location),
                Networks = make_set(NetworkLocationDetails)
        by UserPrincipalName, DeviceTrust, AuthMethod;
let MfaChanges =
    AuditLogs
    | where TimeGenerated > ago(lookback)
    | where OperationName has_any ("security info", "authentication method")
    | extend TargetUser = tostring(TargetResources[0].userPrincipalName),
             Actor = tostring(InitiatedBy.user.userPrincipalName),
             ActorIp = tostring(InitiatedBy.user.ipAddress)
    | where Actor !has "onmicrosoft.com"
    | project MfaChangeTime = TimeGenerated, OperationName, TargetUser, Actor, ActorIp;
SuspiciousSignins
| join kind=leftouter (MfaChanges) on $left.UserPrincipalName == $right.TargetUser
| project UserPrincipalName, FirstSeen, IPs, Locations, Networks, AuthMethod,
          MfaChangeTime, OperationName, Actor, ActorIp
| sort by FirstSeen desc

-- Hunt: Vishing-assisted remote access tools + AitM phishing page artifacts
-- Scope: Executive workstations during the suspected intrusion window

LET rats <= SELECT Pid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Exe =~ '(?i)(quickassist|anydesk|teamviewer|screenconnect|splashtop|rustdesk|ammyy|goxtoassist|zoho)'

LET history <= SELECT * FROM foreach(
  row={ SELECT FullPath FROM glob(globs='C:/Users/*/AppData/Local/*/Chrome/User Data/*/History') },
  query={ SELECT url, title, last_visit_time
          FROM sqlite(file=FullPath, query='SELECT url, title, last_visit_time FROM urls ORDER BY last_visit_time DESC LIMIT 5000')
          WHERE url =~ '(?i)(login|signin|okta|microsoft|office)'
            AND url !~ '(?i)(login\\.microsoftonline\\.com|login\\.microsoft\\.com|login\\.live\\.com|myapplications\\.microsoft\\.com)' })

SELECT * FROM rats
UNION ALL
SELECT NULL AS Pid, 'BROWSER_HISTORY' AS Name, url AS Exe,
       title AS CommandLine, NULL AS Username, last_visit_time AS CreateTime
FROM history

# Requires: Microsoft.Graph PowerShell SDK, run with an admin holding
# User.ReadWrite.All, Directory.Read.All, IdentityRiskyUser.Read.All, MailboxSettings.Read
Connect-MgGraph -Scopes "User.ReadWrite.All","Directory.Read.All","IdentityRiskyUser.Read.All","MailboxSettings.Read" -NoWelcome

$VictimUPN = Read-Host "Enter UPN of the suspected compromised executive"

# 1. Revoke all active sessions and refresh tokens (kills replayed AitM tokens)
Revoke-MgUserSignInSession -UserId $VictimUPN
Write-Host "[+] All sessions and refresh tokens revoked for $VictimUPN" -ForegroundColor Green

# 2. Inventory authentication methods — look for unfamiliar phones/apps added recently
$methods = Get-MgUserAuthenticationMethod -UserId $VictimUPN -All
$methods | Select-Object Id, CreatedDateTime,
    @{n='MethodType';e={$_.AdditionalProperties.'@odata.type'}} |
    Format-Table -AutoSize
Write-Host "[!] Review the list above. Any phone number or app not verified with the user must be deleted:" -ForegroundColor Yellow
Write-Host '    Remove-MgUserAuthenticationPhoneMethod -UserId $u -PhoneAuthenticationMethodId <id>' -ForegroundColor DarkGray

# 3. Check for malicious inbox rules (auto-forward/delete to hide extortion comms or exfil)
$rules = Get-MgUserMailFolderMessageRule -UserId $VictimUPN -MailFolderId inbox -All
$rules | Where-Object {
    $_.Actions.ForwardTo -or $_.Actions.RedirectTo -or $_.Actions.Delete
} | Select-Object DisplayName, IsEnabled,
    @{n='ForwardTo';e={$_.Actions.ForwardTo.emailAddress.address -join ','}},
    @{n='RedirectTo';e={$_.Actions.RedirectTo.emailAddress.address -join ','}} |
    Format-List

# 4. Recent risky sign-ins for the account
Get-MgRiskyUser -Filter "userPrincipalName eq '$VictimUPN'" |
    Select-Object UserPrincipalName, RiskLevel, RiskState, RiskLastUpdatedDateTime

# 5. Force password reset as belt-and-suspenders (does NOT invalidate stolen cookies by itself —
#    session revocation in step 1 is the critical action)
Write-Host "[!] Next steps: reset the password, re-register MFA from a KNOWN-GOOD device," -ForegroundColor Yellow
Write-Host "    verify no new Conditional Access exclusions, and sweep mailbox/SharePoint audit logs." -ForegroundColor Yellow