Marq USES Office 365
Marq supported Office 365 issues in his role as a Microsoft Exchange engineer.
Explicit Confidence 97% · Marq EP 108 Details
“it could be Office 365 issues, in the Cloud”
Software
software:office_365
Also: Microsoft 365, Microsoft Office 365
Cloud email and productivity service mentioned as an Exchange environment supported by Marq.
Cloud email and productivity service mentioned as an Exchange environment supported by Marq.
“it could be Office 365 issues, in the Cloud”
Microsoft cloud administration and productivity platform used by the Academy for accounts, email, devices, Active Directory settings and administrative access.
“He was logged into the school’s admin portal on Office 365.”
“This is the tool the Academy used to manage the school’s network”
Email environment used as an example of what a victim might incorrectly assume has been taken over during a BEC incident.
“somebody has taken over my Office 365 e-mail server”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| incoming | USES | Marq | Explicit | 108 |
| incoming | USES | The Academy | Explicit | 113 |
| incoming | USES | Adam Georgeson | Explicit | 113 |
| incoming | INITIAL_ACCESS_VIA | Academy network attack | Derived | 113 |
| incoming | INVOLVES | Unnamed IT company network attack | Explicit | 113 |
Marq USES Office 365
Marq supported Office 365 issues in his role as a Microsoft Exchange engineer.
Explicit Confidence 97% · Marq EP 108 Details
“it could be Office 365 issues, in the Cloud”
The Academy USES Office 365
The Academy used Office 365 to manage its network, users, and email.
Explicit Confidence 99% · Jack Rhysider EP 113 Details
“This is the tool the Academy used to manage the school’s network, like usernames and e-mail boxes and that sort of thing.”
Adam Georgeson USES Office 365
Adam used the Academy’s Office 365 administrator portal to access accounts and administrative functions.
Explicit Confidence 99% · Jack Rhysider EP 113 Details
“I was logged into the school’s admin portal on Office 365.”
Academy network attack INITIAL_ACCESS_VIA Office 365
The attack initially gained access through the Academy’s Office 365 administrator account.
Derived Confidence 96% · Jack Rhysider EP 113 Details
“He was logged into the school’s admin portal on Office 365.”
Unnamed IT company network attack INVOLVES Office 365
The later attack against Adam’s employer involved logging into the company’s Office 365 portal and reaching its global administrator account.
Explicit Confidence 99% · Jack Rhysider EP 113 Details
“He uses the domain admin credentials that he still had written down somewhere to log into this company’s Office 365 portal.”