Office 365 Security

[discoveranother]

Hello

 

Had a situation where office 365 emails are being hacked, this seems to be a current trend at the moment..

 

What is happening is, clients are receiving emails from other businesses looking like the emails have been legitimately sent to them from a valid email address i.e. [email protected] sends email to [email protected]

 

Customer B opens the email which requests that they login with their credentials to view the email message, which then provides the hacker with the username and password.

 

What happens is the hacker sends emails from that particular account which has been hacked. The recipient thinks the email is valid.

 

I've heard this happening elsewhere quite frequently, and it happened to one of my clients the other day. I reset all office 365 account passwords which generally fixes the issue.

 

I just wondered how I can check thoroughly in office 365 where accounts have been compromised, if they are still being compromised or anyway to provide more security. I know I can set it whereby a passcode or 2 factor authentication can be implemented.

 

 

Thanks all

[Boredguy]

We have setup a mail rule in 365 so that any e-mail that is sent from outside the organisation with one of our domain names automatically gets a warning message

Apply rule to messages

from users that are 'Outside the organization'

   and sent to users that are 'Inside the organization'

   and where the From address contains 'contoso.com'

prepend message subject with '[sPOOFED ADDRESS]'

   and prepend '*** Warning Message to your users ***' and fallback to 'wrap' if unable to apply.

   and set the spam confidence level to '6'

except when the From address contains '[email protected]'

[jthompson]

Hello

 

Had a situation where office 365 emails are being hacked, this seems to be a current trend at the moment..

 

 

Have a look at the threads 'Phishing and Spam emails' and 'Email filtering regex'. It sounds like you're describing the same types of messages that others have had some success in combating. You may be able to prevent such messages reaching your users' inbox.

 

We have setup a mail rule in 365 so that any e-mail that is sent from outside the organisation with one of our domain names automatically gets a warning message

 

If you haven't already, have a look at implementing DMARC (which includes SPF and DKIM, too). It'll give you some control over how other email systems across the Internet deal with emails that are attempting to spoof your domain.

 

I'd have also thought you'd want to just block any such messages coming into your email server, rather than merely attach a warning notice.

[TechMonkey]

We have setup a mail rule in 365 so that any e-mail that is sent from outside the organisation with one of our domain names automatically gets a warning message

Apply rule to messages

from users that are 'Outside the organization'

   and sent to users that are 'Inside the organization'

   and where the From address contains 'contoso.com'

prepend message subject with '[sPOOFED ADDRESS]'

   and prepend '*** Warning Message to your users ***' and fallback to 'wrap' if unable to apply.

   and set the spam confidence level to '6'

except when the From address contains '[email protected]'

 

Can I ask what the final line does or what it is a placeholder for?

Edited February 7, 2019 by TechMonkey
Added quote

[Boredguy]

Its for any external services you might have that should be using your external address for a valid reason, such as remote helpdesk etc

If you don't have any, then you do not need the exception

[Boredguy]

If you haven't already, have a look at implementing DMARC (which includes SPF and DKIM, too). It'll give you some control over how other email systems across the Internet deal with emails that are attempting to spoof your domain.

 

We already have SPF and DKIM, this rule is just another line of defence in case something slips through all the other rules.