The Case For SigParser
ID: f27e4afb-86f1-5a2f-985b-f79d303e10d5
STIX ID: report--f27e4afb-86f1-5a2f-985b-f79d303e10d5
Feed Name: Huntress Blog
Threat Score
Huntress describes an anonymized Microsoft 365 account takeover where an AitM capture (axios user agent) enabled account access from datacenter IPs, creation of a malicious inbox rule to intercept partner emails, and installation of the SigParser OAuth app (app ID caffae8c-0882-4c81-9a27-d1803af53a40) to enumerate contacts for follow-on BEC/spearphishing; the SOC remediated the account and the report recommends auditing OAuth consents and disabling user app consent to reduce Rogue App abuse.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.