The SaaS RootKit: A New Attack Vector for Hidden Forwarding Rules in O365

on YouTube ↗44m

" summary

Demonstrates a newly identified vulnerability in Microsoft OAuth application registrations that lets an attacker use Exchange’s legacy API to create hidden forwarding rules in Office 365 mailboxes. Includes a walkthrough of Microsoft’s OAuth registration process and a demonstration of exploiting that registration to implement the hidden forwarding rules.

AI-written summary · about

" chapters (13)

1. 0:00Start
2. 2:33Agenda
3. 3:53What Are Inbox Rules in Microsoft 365?
4. 9:08The Discovery of Hidden Inbox Forwarding Rules
5. 11:54Microsoft's Response to Damian
6. 12:53The Next Evolution in Hidden Forwarding Rules: an Attack Method Through SaaS
7. 18:31Undocumented Resources - No Server Side Validation
8. 19:493rd Party App Access Through OAuth 2.0
9. 22:16A Look at OAuth & 3rd Party App Access
10. 24:32Abusing Exchange Online Legacy API
11. 32:36Discussion: What Just Happened?
12. 36:14SSPM Survey Report 2022 3rd party app access is a top concern
13. 37:53How to Best Mitigate a SaaS Rootkit Attack

" related talks

• 40mFighting Where They Aren't: How Attackers Avoid Endpoints in Modern AttacksSnir Ben Shimol, Brian Vecci · RSAC 2021
• 01h 00mDefending Against New Phishing Attacks that Abuse OAuth Authorization FlowsJenko Hwong · OWASP 2022 Global AppSec Europe Virtual Event
• 23mHacking Exposed: Next-Generation Tactics, Techniques, and ProceduresMichael Sentonas · RSAC Conference 2021
• 50mAttacking and Defending the Microsoft Cloud (Office 365 & Azure AD)Sean Metcalf, Mark Morowczynski · Black Hat USA 2019
• 37mMicrosoft Defender for Office 365 Evasion - The Story of Confirmed VulnerabilitySergey Chubarov · Black Hat Europe 2022
• 58mPrivilege Escalation in Microsoft AzureChristian August Holm Hansen · NDC Security 2025
• 22mSSO Wars: The Token MenaceAlvaro Munoz, Oleksandr Mirosh · Black Hat USA 2019
• 43mHunting for Bugs, Catching DragonsNicolas Joly · Black Hat USA 2019