TeamFiltration: Password Spray to Forgotten Service Account Takeover

An identity alert at 18:52 UTC on 14 August bundles nearly two hundred failed sign-ins to Microsoft Teams from cloud-hosted addresses against most of the directory, the first of several rounds that night. Sprays of this shape come from TeamFiltration, which presents a fixed client string to the sign-in service on every attempt. Working from the identity sign-in records of that evening, find the user agent the burst shares and report the Teams client version it claims to be.

Nearly every attempt in the burst came back with a credential error, which is exactly what makes the alert easy to file as blocked and forget. Work through the result codes of the TeamFiltration burst and determine whether any attempt in it ended in a token. If one did, report the first account that got it.

One of the accounts that signed in during the burst was used again within a minute, from an address outside the cloud ranges that carried the spray. Follow that account's later sign-ins and report the address they came from.

From that same address the account tried several applications in turn. One of them required a second factor and, because the account had no method registered, the sign-in was interrupted with an enrollment prompt instead of a token. Identify that application.

After the portal stopped at the second factor, the account TeamFiltration had opened kept going from the same address and reached the company's documents. One of those later sign-ins was not a page the operator opened but a token issued silently to an application for Microsoft Graph, the API behind mail, files and the directory. Identify the application that obtained that Graph token for the account, and report its application ID as the sign-in records carry it.