petergs petergs

Fidelity SMS Phishing Campaign November 2024

Overview

Fidelity-themed phishing campaign observed November 2024

Techniques & Tactics

Use of CloudFlare anti-bot features to prevent automated access
Use of server-based User-Agent checks to discourage access by non-phone devices
Use of Javascript-based checks on viewport dimensions and User-Agent to discourage access by non-phone devices
Phishing

Microsoft Graph CLI Cheatsheet

I've generally found the Microsoft Graph CLI (mgc) hard to work with. In many cases, harder than using the Graph API endpoints directly or language-specific SDKs. In general, Entra directory-related commands seem to work well, but other parts of the Graph API are rough around the edges from a usability perspective.

This doc provides some quick examples so I never have to work through the trial-and-error of figuring them out again.

OneDrive

Listing and downloading items

Bookmarks

MacOS

MacOS DFIR

Apple Unified Log

Microsoft

Azure / Entra / M365

terraform plan -out=tfplan
terraform show tfplan | less -R

	import requests
	import json
	import pathlib
	import sys

	def upload(access_token: str, file_path: str, file_name: str):
	headers = {
	'Authorization': f'Bearer {access_token}',
	'Content-Type': 'text/plain'
	}

	<#
	File: Invoke-EnumerateAzureBlobs.ps1
	Author: Karl Fosaaen (@kfosaaen), NetSPI - 2018
	Description: PowerShell function for enumerating public Azure Blob file resources.
	Parts of the Permutations.txt file borrowed from - https://github.com/brianwarehime/inSp3ctor

	Small updates by @petergs captured in these PRs:
	- https://github.com/NetSPI/MicroBurst/pull/53
	- https://github.com/NetSPI/MicroBurst/pull/54
	#>

	# 1. install iamlive
	brew install iann0036/iamlive/iamlive

	# 2. run iamlive
	iamlive --mode proxy --output-file readonly.json --force-wildcard-resource

	# 3. in a separate terraform window
	export HTTP_PROXY=http://127.0.0.1:10080
	export HTTPS_PROXY=http://127.0.0.1:10080
	export AWS_CA_BUNDLE=~/.iamlive/ca.pem

	#!/bin/bash
	curl "https://login.microsoftonline.com/getuserrealm.srf?login=$1&json=1"