applied security research
Rik van Duijn - 26 mei 2020
Phishing aftercare

Handling user-reports
Recently we got another message: “Hey is this right?” including a screenshot of an email. The email described the email storage quota was exceeded. And in the attachments a word document with the instructions on how to fix the quota. The email message used the organization name and so did the filename of the word document. It’s still unclear if this is a phishing test by the organization or an actual phishing attempt. We used this phishing scenario in the past so it did feel like phishing but in the end it didn’t feel right. So I advised to contact their IT department. The immediate response was they didn’t want to do so: the last phishing message they forwarded, returned a snarky response stating they didn’t follow proper procedure. Which is unfortunate: as a defender getting these messages from our colleagues helps us to detect threats. Recently the university of Maastricht was hacked and ransomed. The initial vector: phishing. phishing. Awareness and reporting on its own is obviously not enough but making sure everyone reports if they see something suspicious will help. Next to making it easy to report users need to receive feedback of their report. If someone feels they are contributing they will be more willing to send them in.Helping users report phishing
Having a quick and easy procedure to receive the messages is important. But we need the original message so we could instruct users to only forward as attachment. But this is not a button that is in the main screen and would require users to click around. As IT we sometimes forget that an employee is not there to act as a human spam filter. So that notification should be made as simple as possible. It is easy for office365 and exchange users to receive notification from users. A user can classify an email as spam or phishing in the web interface.
Configure mailflow:
Setting up the mail flow rule can be done in 2 ways, via the GUI and via powershell.Via the GUI
- Log in to the Exchange Admin center
- Select “email flow”
- Select “rules”
- Create a new rule with the following properties:
- Apply this rule if … Recipient is “abuse@messaging.microsoft.com” or “junk@office365.microsoft.com” or “phish@office365.microsoft.com”
- Do the following … BCC or Redirect* the message to “an email address you like”

PowerShell FTW:
What can be done by hand is easier with PowerShell, replace -BlindCopyTo with -RedirectMessageTo if you don’t want these messages to be sent to Microsoft. The script is also available in our Github repository:
#Modify email adress and rule name below:
$recipient = "YOUREMAILADRESS"
$name = "[ZOLDER] Recieve user alerts"
New-TransportRule $name -SentTo "abuse@messaging.microsoft.com","junk@office365.microsoft.com","phish@office365.microsoft.com" -BlindCopyTo $recipient -StopRuleProcessing $false -Mode "Enforce" -Comment "" -RuleErrorAction "Ignore" -SenderAddressLocation "Header"
Bonus
You can add text or html to any email from outside of the company. This allows you to add a warning to emails from external sources. Which could help users identify false messages. We’ve added the script to our Github repository, use it to add this to your o365 environment. You can add your own organisation name, the layout looks like this:
Blogs
Zolder.App LIVE Presentations
During #CES2021 we will host a daily LIVE event in Microsoft Teams – OPEN FOR ALL, so also available for non-CES-visitors and non-Teams-users. Monday – Tuesday – Wednesday from 17:00 – 17:30 CET / 11:00 – 11:30 AM EST. The events will be hosted by Erik Remmelzwaal in English. The sessions will be opened for […] Lees verder#CES2021 - We Are Ready!
We are very excited to be part of the #CES2021NL mission! Meet us at CES (Januari 11-14) in our online booth 10609 and see how we solve global challenges with NLTech. Erik Remmelzwaal, Co-Founder & CEO Yes I indeed think we are ready for CES. At this virtual event we will showcase Zolder.App. I am […] Lees verderAzure App Consent Policies
OAuth consent phishing has been on the rise for a while now. Unsurprisingly, Microsoft has gradually introduced measures to protect from this type of attack. Latest: Risk-Based Step-Up Consent. Lees verderHoneytokens using Azure Keyvaults
In 2017 Wesley and I gave a presentation at SHA2017 about honey/pot/tokens. We actually planned on building a fully fledged platform. But never came further then the POC phase of that project. This week we got a product demo from the guys at Thinkst, i’ve always loved this way of thinking: let the attacker come […] Lees verderRisk of exposed home automation services
At home, I am automating many things for fun. Currently I am using Home Assistant, an incredibly powerful piece of software for automating your home. Regularly I am combining the home automation experiences with security. Home automation is often related to physical things such as changing lights, moving curtains, opening door locks or turning the […] Lees verderHacking the traffic light of the future
Nowadays we are connecting everything we can think of to the internet. Usually to make our lives easier or more comfortable. Some of the new upcoming innovations are related to making our traffic smart with the goal to improve safety, comfort and the traffic flow. We dived into this technology to analyze the inner workings and identify potential security risks. Lees verderDetect lateral movement with Azure Sentinel
Lately we have been setting up a the production network for our Zolder.App service. The network consists of multiple segments separated by a firewall. As an addition we wanted to add monitoring features into the network. If an attacker is in our network, we would like to get a notification. Lees verderDetecting BEC fraud using Azure Sentinel
Business Email Compromise (BEC) Fraud inflicts the most damage of all types of cybercrime, according to the FBI. How to detect such attacks using Azure Sentinel? Rik shares some actual possibilities. Lees verderPhishing aftercare
This blog is part of our Office 365 attack & defense series. We also maintain a Github page where we share our Office 365 tools and queries. We often get sent phishing emails by family and friends. Not to phish us but because we ask family and friends to forward them to us. Sometimes they […] Lees verderInside a phishing panel
Dutch and Belgium citizens are receiving phishing attacks every day. But how does that exactly work? Lees verderOffice 365 - Exchange rules
This blog is part of our Office 365 attack & defense series. We also maintain a Github page where we share our Office 365 tools and queries. Exchange rules can be useful in managing the emails we receive on a daily basis. For example, it allows users to automatically respond or move specific emails to […] Lees verderOffice 365 - malicious applications
Wesley dives into the App Registrations feature of Microsoft Azure Active Directory. Finds ways to abuse it through delegate & application permissions and shares ideas howto protect from such abuse. Lees verderWindows terminal profile fun
Rik plays around with the preview version of Windows Terminal to find manipulation options. Lees verderBuilding a Zolder logo
Wesley writes about his most recent IoT project: building a Zolder logo with WS2812B ledstrips behind it, to give it some cool effects. Lees verderZoldersessions
Zolder.App LIVE Presentations
#CES2021 - We Are Ready!
Azure App Consent Policies
Honeytokens using Azure Keyvaults
Risk of exposed home automation services
Hacking the traffic light of the future
Detect lateral movement with Azure Sentinel
Detecting BEC fraud using Azure Sentinel
Phishing aftercare
Inside a phishing panel
Office 365 - Exchange rules
Office 365 - malicious applications