Kriminal AI Platform: Defending Against Guardrail-Free AI Phishing, Deepfake Social Engineering, and Automated OSINT Recon

---
title: Inbox Rule Created to Hide Security or Reply-Chain Emails
id: 3f8c1a42-7d2e-4b91-a5c6-9e0f2d4b8a17
status: experimental
description: Detects creation of Exchange/OWA inbox rules that delete, move, or mark-as-read emails containing security, fraud, or reply keywords — a hallmark of BEC and AI-phishing mailbox takeover used to conceal attacker activity from the legitimate user.
references:
  - https://attack.mitre.org/techniques/T1114/003/
  - https://www.darkreading.com/application-security/no-filter-kriminal-ai-platform-cybercrime-concerns
author: Security Arsenal
date: 2026/06/15
tags:
  - attack.persistence
  - attack.defense_evasion
  - attack.t1114.003
logsource:
  product: o365
  service: exchange
detection:
  selection_operation:
    Operation:
      - 'New-InboxRule'
      - 'Set-InboxRule'
      - 'UpdateInboxRules'
  selection_action:
    Parameters|contains:
      - 'DeleteMessage'
      - 'MoveToFolder'
      - 'MarkAsRead'
  selection_keywords:
    Parameters|contains:
      - 'invoice'
      - 'payment'
      - 'wire'
      - 'phish'
      - 'security alert'
      - 'suspicious'
      - 'verify'
      - 'password'
  condition: selection_operation and selection_action and selection_keywords
falsepositives:
  - Users with legitimate mail-sorting rules (rare for delete+keyword combinations); validate with the mailbox owner
level: high
---
title: Browser or Office Application Spawning Script Interpreter
id: 8b2e5d19-4c6a-4f83-b1d7-3a9c0e5f6d28
status: experimental
description: Detects browsers or Office applications spawning cmd, PowerShell, mshta, wscript, or rundll32 — consistent with AI-crafted phishing lures that direct users to malicious links or ClickFix-style self-execution instructions.
references:
  - https://attack.mitre.org/techniques/T1204/002/
  - https://www.darkreading.com/application-security/no-filter-kriminal-ai-platform-cybercrime-concerns
author: Security Arsenal
date: 2026/06/15
tags:
  - attack.execution
  - attack.t1204.002
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\msedge.exe'
      - '\chrome.exe'
      - '\firefox.exe'
      - '\brave.exe'
      - '\winword.exe'
      - '\excel.exe'
      - '\powerpnt.exe'
      - '\outlook.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\mshta.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\curl.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Browser extensions or enterprise tooling invoking shells (uncommon); baseline per business unit
level: high
---
title: Suspicious OAuth Application Consent Grant
id: c14d7f60-2a8b-4e95-9031-5f6b2c8d9e34
status: experimental
description: Detects user consent granted to third-party OAuth applications requesting high-risk mail or offline scopes — a common persistence mechanism in AI-generated consent-phishing campaigns that survive password resets.
references:
  - https://attack.mitre.org/techniques/T1550/001/
  - https://www.darkreading.com/application-security/no-filter-kriminal-ai-platform-cybercrime-concerns
author: Security Arsenal
date: 2026/06/15
tags:
  - attack.persistence
  - attack.credential_access
  - attack.t1550.001
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    operationName:
      - 'Consent to application'
      - 'Add service principal'
      - 'Add app role assignment to service principal'
  selection_scopes:
    properties|contains:
      - 'Mail.Read'
      - 'Mail.ReadWrite'
      - 'Mail.Send'
      - 'offline_access'
      - 'full_access_as_app'
      - 'Files.ReadWrite.All'
  condition: selection and selection_scopes
falsepositives:
  - Approved enterprise SaaS integrations; maintain an allowlist of vetted application IDs
level: high

let lookback = 14d;
let risky_signins = SigninLogs
| where TimeGenerated > ago(lookback)
| where RiskLevelDuringSignIn in ("high", "medium") or RiskEventTypes_V2 != "[]"
| project UserPrincipalName, SignInTime = TimeGenerated, IPAddress, Location, AppDisplayName;
let mailbox_actions = union isfuzzy=true
    (OfficeActivity
    | where TimeGenerated > ago(lookback)
    | where Operation in~ ("New-InboxRule", "Set-InboxRule", "UpdateInboxRules", "Add delegation", "HardDelete")
    | project UserId = tostring(parse_json(OfficeObjectId)), ActionTime = TimeGenerated, Operation, Parameters = tostring(parse_json(Parameters))),
    (AuditLogs
    | where TimeGenerated > ago(lookback)
    | where OperationName in~ ("Consent to application", "Add service principal")
    | extend UserId = tostring(parse_json(tostring(InitiatedBy.user)).userPrincipalName)
    | project UserId, ActionTime = TimeGenerated, Operation = OperationName, Parameters = tostring(TargetResources));
risky_signins
| join kind=inner mailbox_actions on $left.UserPrincipalName == $right.UserId
| where ActionTime between (SignInTime .. SignInTime + 1d)
| project UserPrincipalName, SignInTime, IPAddress, Location, Operation, ActionTime, Parameters
| sort by SignInTime desc

-- Hunt for recently created script/payload artifacts in user-writable directories
LET cutoff = now() - 60 * 60 * 24 * 7
SELECT FullPath, Size, Mtime, Btime,
       upload(file=FullPath) AS Sample
FROM glob(globs=[
  'C:/Users/*/Downloads/*.ps1',
  'C:/Users/*/Downloads/*.hta',
  'C:/Users/*/Downloads/*.js',
  'C:/Users/*/Downloads/*.vbs',
  'C:/Users/*/Downloads/*.bat',
  'C:/Users/*/AppData/Local/Temp/*.ps1',
  'C:/Users/*/AppData/Local/Temp/*.hta',
  'C:/Users/*/AppData/Roaming/*/*.js'
], accessor='ntfs')
WHERE Mtime > cutoff
ORDER BY Mtime DESC

# Requires: ExchangeOnlineManagement, Microsoft.Graph modules
# Run as: Global Reader / Exchange Admin (least-privilege read roles suffice)

Connect-ExchangeOnline
Connect-MgGraph -Scopes "AuditLog.Read.All","Application.Read.All","Policy.Read.All"

# 1. Sweep all mailboxes for suspicious auto-forwarding / hiding rules
Get-Mailbox -ResultSize Unlimited | ForEach-Object {
    Get-InboxRule -Mailbox $_.PrimarySmtpAddress -ErrorAction SilentlyContinue |
    Where-Object {
        $_.ForwardTo -or $_.RedirectTo -or $_.DeleteMessage -eq $true -or
        ($_.MoveToFolder -and $_.SubjectOrBodyContainsWords)
    } |
    Select-Object @{N='Mailbox';E={$_.MailboxOwnerId}}, Name, ForwardTo, RedirectTo,
                  DeleteMessage, MoveToFolder, SubjectOrBodyContainsWords
} | Export-Csv .\SuspiciousInboxRules.csv -NoTypeInformation

# 2. Enumerate user-consented OAuth grants with high-risk scopes
$spns = Get-MgServicePrincipal -All
foreach ($spn in $spns) {
    Get-MgServicePrincipalOauth2PermissionGrant -ServicePrincipalId $spn.Id -ErrorAction SilentlyContinue |
    Where-Object { $_.Scope -match "Mail\.|offline_access|Files\.ReadWrite\.All|full_access" } |
    Select-Object @{N='App';E={$spn.DisplayName}}, ClientId, Scope, ConsentType
}

# 3. Verify legacy auth is blocked (conditional access baseline)
Get-MgIdentityConditionalAccessPolicy |
Select-Object DisplayName, State, @{N='ClientAppTypes';E={$_.Conditions.ClientAppTypes}} |
Format-Table -AutoSize

# 4. Report external auto-forwarding (disable org-wide if not required)
Get-HostedOutboundSpamFilterPolicy |
Select-Object Name, AutoForwardingMode
# Harden: Set-HostedOutboundSpamFilterPolicy -Identity Default -AutoForwardingMode Off