This article examines threat hunting for business email compromise (BEC) in Microsoft 365 by analyzing anomalous user agents in telemetry. It details how Huntress identified and validated malicious authentications linked to a rare AZURECLI/Azsdk-python user agent, and how findings were shared with the community to drive remediation and prevention. #AZURECLI #AzsdkPython #Impacket #AADInternals #Huntress #Microsoft365 #BEC
Keypoints
- Threat hunting framed around whether anomalous user agents in Microsoft 365 telemetry can signal business email compromise (BEC).
- User agents themselves are not inherently malicious, and many tools default to their own agents, complicating detection.
- Huntress focused on rare, contextually anomalous user agents and correlated them with login events to flag potential abuse.
- The rare agent AZURECLI/2.47.0 (DEB) azsdk-python-azure-mgmt-resource was linked to suspicious activity, including four successful logins across June 2023.
- Telemetry showed 85 hits for this agent, with the majority being login failures and only a few successful authentications, prompting deeper investigation.
- Found cross-territory patterns (e.g., Belgium → Korea; an Indonesian IP attempting many sign-ins) supporting malicious use of credentials.
- The team issued true-positive BEC reports and remediation guidance to the Huntress community, demonstrating value of human-assisted threat detection.
- Detection logic emerged: event.action: UserLoggedIn AND user_agent.original.text:”azsdk-python”, which was then pushed to production.
- Prevention emphasis centered on MFA and complex conditional access to curb early-stage compromise in cloud environments.
MITRE Techniques
- [T1078.004] Valid Accounts – Initial access via rare or malicious credentials; 85 hits for the suspicious user agent with four successful authentications across June 2023, indicating potential credential abuse. ‘four successful authentications for four user accounts, in all of June 2023.’
- [T1059.006] Python – Use of Python-based tooling (azsdk-python-azure-mgmt-resource) to authenticate and interact with Azure services. ‘AZURECLI/2.47.0 (DEB) azsdk-python-azure-mgmt-resource’
Indicators of Compromise
- [IP Address] Malicious endpoints observed in IoCs – 213.154.80.21, 203.251.62.51, 91.158.221.9, 118.98.90.2
- [User-Agent] Suspicious user-agent string associated with Azure CLI/Python tooling – AZURECLI/2.47.0 (DEB) azsdk-python-azure-mgmt-resource
Read more: https://www.huntress.com/blog/threat-hunting-for-business-email-compromise-through-user-agents