THREAT OPS › Threat News › Passkey-themed social engineering leads to identity and cloud compromise
Passkey-themed social engineering leads to identity and cloud compromise
<aside class="table-of-contents-block accordion wp-block-bloginabox-theme-table-of-contents" id="accordion-8cf2f899-dac8-4023-8839-1fb6d6ae5eff"> <button class="btn btn-collapse" type="button"> <span class="table-of-contents-block__label">In this article</span> <span class="table-of-contents-block__current"></span>
<svg class="table-of-contents-block__arrow" fill="none" height="11" viewBox
MITRE ATT&CK techniques
- Adversary-in-the-MiddleT1557
- Acquire InfrastructureT1583
- SharepointT1213.002
- IP AddressesT1590.005
- Permission Groups DiscoveryT1069
- Email CollectionT1114
- Cloud GroupsT1069.003
- Spearphishing LinkT1598.003
- Automated CollectionT1119
- Data from Cloud StorageT1530
- Cloud AccountsT1586.003
- Email AccountsT1586.002
- Exfiltration Over Web ServiceT1567
- DomainsT1583.001
- Social EngineeringT1684
- Email AccountsT1585.002
- Account DiscoveryT1087
- Web ServiceT1102
- Cloud ServicesT1021.007
- Cloud AccountT1087.004
- Cloud AccountsT1585.003
- Gather Victim Org InformationT1591
- Cloud AccountT1136.003
- Valid AccountsT1078
- Multi-Factor AuthenticationT1556.006
- Social MediaT1593.001
- CredentialsT1589.001
- Phishing for InformationT1598
- ImpersonationT1684.001
- Establish AccountsT1585
- Data from Information RepositoriesT1213
- Cloud AccountsT1078.004
- Modify Authentication ProcessT1556
- Acquire InfrastructureAML.T0008
- Valid AccountsAML.T0012
- Establish AccountsAML.T0021
- Data from Information RepositoriesAML.T0036
- ImpersonationAML.T0073
Indicators of compromise
- https://microsoft.github.io/zerotrustassessment/url
- company-name.integratedsso.comdomain
- company-name.secure-passkey.comdomain
- companyname.maliciousdomain.comdomain
- contoso.add-passkey.comdomain
- passkeyhelpdesk.comdomain
- secure-passkey.comdomain
- setupmypasskey.comdomain
- add-passkey.comdomain
- integratedsso.comdomain
- oktasession.comdomain
- keysyncos.comdomain
- oskeysync.comdomain
- oskeysetup.comdomain
- oskeyregister.comdomain
- syncmykey.comdomain
- myconnectkey.comdomain
- oskeyconnect.comdomain
- validationsetupac.comdomain
- portalsetuphub.comdomain