UAT-11587 Antino Backdoor Turns Microsoft 365 Into a C2 Channel — Detection and Hardening Guide for Defenders

---
title: Non-Office Process Connecting to Microsoft Graph or Exchange Online Endpoints
id: 4a9e2c17-8b3d-4f56-a291-7c1e5d8f2034
status: experimental
description: Detects network connections to Microsoft Graph or Exchange Online API endpoints from processes that are not legitimate Microsoft 365 clients. Consistent with implants such as the UAT-11587 Antino backdoor using M365 as a C2 channel.
references:
  - https://securityaffairs.com/200264/apt/antino-backdoor-uses-your-inbox-as-its-control-panel.html
  - https://attack.mitre.org/techniques/T1102/002/
  - https://attack.mitre.org/techniques/T1071/001/
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.command_and_control
  - attack.t1102.002
  - attack.t1071.001
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationHostname|contains:
      - 'graph.microsoft.com'
      - 'outlook.office365.com'
      - 'outlook.office.com'
      - 'substrate.office.com'
  filter_known_clients:
    Image|endswith:
      - '\OUTLOOK.EXE'
      - '\MicrosoftTeams.exe'
      - '\ms-teams.exe'
      - '\OneDrive.exe'
      - '\lync.exe'
      - '\msedge.exe'
      - '\chrome.exe'
      - '\firefox.exe'
      - '\iexplore.exe'
      - '\WINWORD.EXE'
      - '\EXCEL.EXE'
      - '\POWERPNT.EXE'
      - '\SearchProtocolHost.exe'
      - '\msteams.exe'
      - '\PhoneExperienceHost.exe'
      - '\Microsoft.Office.Outlook.Hub.exe'
  condition: selection and not filter_known_clients
falsepositives:
  - Legitimate line-of-business applications integrating with Graph API (validate per-app)
  - EDR and email security tooling polling mailboxes
  - PowerShell/Graph SDK administration by IT staff (tune by process path and user)
level: high
---
title: Suspicious Inbox Rule Creation Indicating Mail Concealment or C2 Staging
id: 8d3b5f90-2c47-4e81-b6a3-9f0d2e7c4156
status: experimental
description: Detects creation of Exchange inbox rules that delete, move to obscure folders, or mark-as-read incoming mail — a technique used by actors like UAT-11587 to hide C2 tasking and exfiltration traffic from the mailbox owner.
references:
  - https://securityaffairs.com/200264/apt/antino-backdoor-uses-your-inbox-as-its-control-panel.html
  - https://attack.mitre.org/techniques/T1098/002/
  - https://attack.mitre.org/techniques/T1114/002/
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.persistence
  - attack.t1098.002
  - attack.collection
  - attack.t1114.002
logsource:
  product: m365
  service: exchange
detection:
  selection:
    Operation:
      - 'New-InboxRule'
      - 'Set-InboxRule'
    Parameters|contains:
      - 'DeleteMessage'
      - 'MoveToFolder'
      - 'MarkAsRead'
      - 'SoftDeleteMessage'
      - 'PermanentDelete'
  condition: selection
falsepositives:
  - Users creating legitimate mail hygiene rules (baseline per-user rule creation rates)
  - Help desk automation creating rules during migrations
level: medium
---
title: Non-Interactive Sign-In to Exchange Online From Unusual Process Pattern
id: 2f7a1d34-6e90-4b28-c845-3a1d9e6b7520
status: experimental
description: Detects non-interactive (client credential / refresh token) authentication to Exchange Online or Microsoft Graph, a pattern consistent with OAuth token abuse by implants using M365 as C2. Tune against known service principals.
references:
  - https://securityaffairs.com/200264/apt/antino-backdoor-uses-your-inbox-as-its-control-panel.html
  - https://attack.mitre.org/techniques/T1550/001/
  - https://attack.mitre.org/techniques/T1528/
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.credential_access
  - attack.t1528
  - attack.t1550.001
logsource:
  product: azure
  service: signinlogs
detection:
  selection:
    resourceDisplayName|contains:
      - 'Microsoft Graph'
      - 'Office 365 Exchange Online'
    isInteractive: false
  filter_known_spn:
    appDisplayName|contains:
      - 'Exchange Online Protection'
      - 'Microsoft '
      - 'Office 365 '
  condition: selection and not filter_known_spn
falsepositives:
  - Legitimate third-party mail hygiene, archiving, and backup services (allowlist by appId after verification)
  - Internal automation service principals
level: high

// Hunt: unknown processes connecting to Microsoft Graph / Exchange Online API endpoints
// Use case: UAT-11587 Antino backdoor C2 over M365 (T1102.002)
let KnownClients = dynamic([
    "OUTLOOK.EXE", "ms-teams.exe", "MicrosoftTeams.exe", "OneDrive.exe",
    "lync.exe", "msedge.exe", "chrome.exe", "firefox.exe",
    "WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "SearchProtocolHost.exe",
    "PhoneExperienceHost.exe"
]);
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemoteUrl has_any ("graph.microsoft.com", "outlook.office365.com", "outlook.office.com", "substrate.office.com")
| where InitiatingProcessFileName !in~ (KnownClients)
| summarize
    ConnectionCount = count(),
    FirstSeen = min(TimeGenerated),
    LastSeen = max(TimeGenerated),
    RemoteUrls = make_set(RemoteUrl, 20),
    RemoteIPs = make_set(RemoteIP, 20),
    Accounts = make_set(InitiatingProcessAccountName, 5)
    by DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessCommandLine
| where ConnectionCount > 20  // sustained beaconing/sync pattern, not a one-off
| order by FirstSeen asc;

// Hunt: non-interactive Graph/Exchange sign-ins by unusual applications
// Use case: OAuth token abuse for mailbox-as-C2 (T1528 / T1550.001)
SigninLogs
| where TimeGenerated > ago(14d)
| where ResourceDisplayName has_any ("Microsoft Graph", "Office 365 Exchange Online")
| where IsInteractive == false
| where AppDisplayName !startswith "Microsoft" and AppDisplayName !startswith "Office 365"
| summarize
    SigninCount = count(),
    SourceIPs = make_set(IPAddress, 10),
    Locations = make_set(Location, 10),
    Users = make_set(UserPrincipalName, 10)
    by AppId, AppDisplayName
| order by SigninCount desc;

// Hunt: inbox rule creation with concealment actions (Office 365 audit)
// Use case: hiding C2 tasking mail from mailbox owner (T1098.002)
OfficeActivity
| where TimeGenerated > ago(30d)
| where Operation in~ ("New-InboxRule", "Set-InboxRule")
| where Parameters has_any ("DeleteMessage", "MarkAsRead", "MoveToFolder", "PermanentDelete")
| project TimeGenerated, UserId, ClientIP, Operation, Parameters, OfficeWorkload
| order by TimeGenerated desc;

-- Hunt: non-Office processes with connections to Microsoft 365 API endpoints
-- Use case: UAT-11587 Antino backdoor C2-over-M365 (T1102.002)
LET known_clients = ("outlook.exe", "ms-teams.exe", "microsoftteams.exe",
    "onedrive.exe", "lync.exe", "msedge.exe", "chrome.exe",
    "firefox.exe", "winword.exe", "excel.exe", "powerpnt.exe")

SELECT
    Pid,
    Name,
    CommandLine,
    Exe,
    Username,
    netstat().RemoteIP AS RemoteIP,
    netstat().RemotePort AS RemotePort,
    netstat().Status AS ConnStatus
FROM pslist()
WHERE netstat().RemotePort = 443
  AND lower(Name) NOT IN known_clients
  AND (
        netstat().RemoteIP =~ '^13\.107\.'      // Microsoft 365 CDN/API ranges
     OR netstat().RemoteIP =~ '^40\.1(2[6-9]|3[0-9])\.'
     OR netstat().RemoteIP =~ '^52\.9[6-9]\.'
     OR netstat().RemoteIP =~ '^52\.10[0-9]\.'
  )

# UAT-11587 / M365-as-C2 Tenant Audit Script
# Run as: Global Administrator or Cloud Application Administrator
# Requires: Microsoft.Graph, ExchangeOnlineManagement modules

Connect-MgGraph -Scopes "Application.Read.All","AuditLog.Read.All","Directory.Read.All"
Connect-ExchangeOnline

# --- 1. Find service principals with high-risk mail scopes ---
$ riskyScopes = @("Mail.Read","Mail.ReadWrite","Mail.Send","Mail.ReadBasic.All",
                  "MailboxSettings.ReadWrite","full_access_as_app")
Write-Host "`n=== Service Principals with High-Risk Mail Scopes ===" -ForegroundColor Cyan
$spns = Get-MgServicePrincipal -All
foreach ($spn in $spns) {
    $assignments = Get-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $spn.Id -ErrorAction SilentlyContinue
    foreach ($a in $assignments) {
        $resource = Get-MgServicePrincipal -ServicePrincipalId $a.ResourceId -ErrorAction SilentlyContinue
        $role = $resource.AppRoles | Where-Object { $_.Id -eq $a.AppRoleId }
        if ($riskyScopes -contains $role.Value) {
            [PSCustomObject]@{
                AppName      = $spn.DisplayName
                AppId        = $spn.AppId
                Scope        = $role.Value
                Resource     = $resource.DisplayName
                CreatedDate  = $spn.AdditionalProperties['createdDateTime']
            } | Format-Table -AutoSize
        }
    }
}

# --- 2. Enumerate user-delegated OAuth consent grants ---
Write-Host "`n=== Delegated OAuth Grants with Mail Permissions ===" -ForegroundColor Cyan
$grants = Get-MgOauth2PermissionGrant -All
$grants | Where-Object { $_.Scope -match "Mail\.|MailboxSettings" } |
    Select-Object ClientId, ConsentType, Scope |
    Format-Table -AutoSize

# --- 3. Hunt concealment inbox rules across all mailboxes ---
Write-Host "`n=== Inbox Rules with Delete/Hide/Move Actions ===" -ForegroundColor Cyan
$mailboxes = Get-Mailbox -ResultSize Unlimited -RecipientTypeDetails UserMailbox
foreach ($mbx in $mailboxes) {
    $rules = Get-InboxRule -Mailbox $mbx.UserPrincipalName -ErrorAction SilentlyContinue
    foreach ($rule in $rules) {
        if ($rule.DeleteMessage -or $rule.MarkAsRead -or
            $rule.MoveToFolder -match "RSS|Deleted|Junk|Archive|Recoverable" -or
            $rule.RedirectTo -or $rule.ForwardTo) {
            [PSCustomObject]@{
                Mailbox      = $mbx.UserPrincipalName
                RuleName     = $rule.Name
                Delete       = $rule.DeleteMessage
                MarkAsRead   = $rule.MarkAsRead
                MoveTo       = $rule.MoveToFolder
                RedirectTo   = $rule.RedirectTo
                ForwardTo    = $rule.ForwardTo
            } | Format-Table -AutoSize
        }
    }
}

# --- 4. Verify Unified Audit Log is enabled (required for detection) ---
Write-Host "`n=== Audit Log Status ===" -ForegroundColor Cyan
Get-AdminAuditLogConfig | Select-Object UnifiedAuditLogIngestionEnabled

Write-Host "`nAudit complete. Review every object above: Antino-style tradecraft persists via consented apps and inbox rules, which survive password resets and MFA." -ForegroundColor Yellow