What is email account takeover (ATO)?

Email account takeover (ATO) is a type of cyberattack where an unauthorized party gains access to a user's email account. Once inside, the attacker can impersonate the user, read emails, send fraudulent messages, exfiltrate data, and use the account as a launchpad for further attacks within the organization.

How do attackers gain access to email accounts?

Attackers typically gain access through various methods, including phishing attacks that trick users into revealing credentials, credential stuffing (using leaked credentials from other breaches), brute-force attacks, or by exploiting vulnerabilities in web applications or systems that store credentials. MFA fatigue attacks are also increasingly common.

What are the most common signs of an ATO in Microsoft 365?

Key indicators of an ATO in Microsoft 365 include suspicious inbox rules (e.g., forwarding emails externally or deleting security alerts), impossible travel (logins from geographically distant locations in short periods), repeated MFA prompts (MFA fatigue), unusual email sending patterns, and unauthorized application consent grants.

How can I proactively detect ATOs in my Microsoft 365 environment?

Proactive detection involves regularly monitoring Microsoft 365 Unified Audit Logs and Azure AD Sign-in Logs for suspicious activities. Implement automated alerts for critical events like new inbox rules, impossible travel, and multiple failed MFA attempts. Additionally, educate users to report unusual activity, as they are often the first to notice a compromise.

What should I do immediately if an email account is taken over?

Immediately disable the compromised account or force a password reset and revoke all active sessions. Then, investigate the scope of the compromise by analyzing audit logs to understand what the attacker accessed or changed. Remove any malicious inbox rules or unauthorized application consents, and then conduct a thorough post-incident review.

Detecting Email Account Takeover in Microsoft 365

Email account takeover (ATO) is a pervasive and dangerous attack vector. Once an attacker gains unauthorized access to an employee's mailbox, they can launch sophisticated phishing campaigns, redirect funds, exfiltrate sensitive data, and escalate privileges within your organization. For organizations heavily reliant on Microsoft 365, understanding the specific indicators of compromise (IOCs) and implementing effective detection and response mechanisms is paramount. This guide focuses on practical, actionable steps to identify and mitigate ATO attacks within your Microsoft 365 environment.

Why are Microsoft 365 accounts a prime target for ATO?

Microsoft 365 accounts are highly sought after by attackers due to the wealth of information and access they provide. An email account is often the digital key to numerous other services through password reset functions. Within Microsoft 365, a compromised account grants access to email, SharePoint, OneDrive, Teams, and potentially other integrated business applications. Attackers leverage this access for a variety of malicious activities, including:

Business Email Compromise (BEC): Impersonating the compromised user to initiate fraudulent wire transfers or change vendor payment details.
Internal Phishing: Sending convincing phishing emails from a trusted internal source to compromise more accounts or deploy malware.
Data Exfiltration: Searching for and downloading sensitive documents from OneDrive or SharePoint.
Credential Harvesting: Using the compromised account to send phishing links that harvest credentials for other services.
Privilege Escalation: Identifying and targeting accounts with higher access levels.

What are the common indicators of email account takeover?

Detecting an ATO often requires a combination of automated monitoring and vigilant user reporting. Attackers frequently attempt to maintain persistence and evade detection. Here are the most common signs:

Suspicious Inbox Rules

This is one of the most common and critical indicators. Attackers create hidden inbox rules to automatically delete incoming emails, forward emails to an external address, or move legitimate emails (like password reset notifications or security alerts) to obscure folders. This allows them to operate undetected for longer periods.

New, unfamiliar rules: Look for rules that forward emails externally, move emails to folders like 'RSS Feeds' or 'Sync Issues', or delete messages containing keywords like 'security' or 'password'.
Rules with cryptic names: Attackers often use names that are hard to distinguish or blend in with legitimate system rules.
Rules set to 'Stop processing more rules': This can prevent legitimate rules from firing.

Impossible Travel

Impossible travel detections occur when a user's account logs in from two geographically distant locations within an implausibly short timeframe. For example, a login from New York followed by a login from London five minutes later. This is a strong indicator of compromise.

Login locations: Monitor user login activity for unusual countries, cities, or IP addresses.
Concurrent logins: Multiple active sessions from different, distant locations.
IP address changes: Sudden shifts in the origin IP address for a user session.

MFA Fatigue and Repeated MFA Prompts

MFA fatigue attacks involve an attacker repeatedly sending multi-factor authentication (MFA) prompts to a user's device. The goal is to annoy the user into accidentally or intentionally approving an authentication request, granting the attacker access.

Unexplained MFA push notifications: Users report receiving numerous MFA prompts they did not initiate.
Failed MFA attempts: A high number of failed MFA attempts for a single user account.
User complaints: Employees reporting constant MFA requests or issues logging in.

Unusual Mailbox Activity

Beyond inbox rules, other changes within the mailbox can signal an ATO.

Delegated access: New, unauthorized mailbox delegates or permissions granted.
Send As/Send on Behalf permissions: Unexplained additions to these permissions.
Unusual email sending patterns: High volume of emails sent, especially to external recipients, or emails sent outside of normal working hours.
Changes to signature or out-of-office replies: Attackers might alter these to aid their phishing or BEC efforts.
New mail contacts or distribution lists: Created by the attacker for future use.

Suspicious Application Consent Grants

Attackers sometimes trick users into granting permissions to malicious third-party applications. These applications can then access user data, send emails, or read files without needing the user's password again.

Unrecognized applications listed in 'My Apps' or 'Enterprise applications'.
Applications with overly broad permissions (e.g., 'Read all mailboxes', 'Send mail as any user').

Signs of Credential Compromise

While not directly an ATO, these often precede one.

Password changes not initiated by the user.
Account lockout events for no apparent reason.
Login attempts from unusual geographies or IP addresses (even if unsuccessful).
Your credentials appearing on dark web forums or paste sites.

How can you detect ATOs in Microsoft 365?

Effective detection relies on leveraging Microsoft 365's built-in tools and potentially third-party security solutions.

Leverage Microsoft 365 Audit Logs

The Unified Audit Log (UAL) in Microsoft 365 is your primary source of truth. It records user and admin activities across Exchange Online, SharePoint Online, Azure AD, and more. Key activities to monitor include:

Mailbox rule creation/modification: Event IDs such as 'New-InboxRule' or 'Set-InboxRule'.
Mailbox permissions changes: 'Add-MailboxPermission', 'Set-MailboxFolderPermission'.
Application consent grants: Look for 'Consent to application' activities.
Mailbox access by non-owners: 'MailboxLogin' events where the 'ClientInfo' indicates an unfamiliar client or IP.
Login activity: 'UserLoggedIn' events, paying close attention to IP addresses and client types.

Monitor Azure AD Sign-in Logs and Risky Sign-ins

Azure AD provides crucial insights into authentication attempts. The 'Sign-ins' log and 'Risky sign-ins' report (Azure AD Identity Protection) are invaluable.

Impossible travel: Detected automatically by Azure AD Identity Protection.
Sign-ins from unfamiliar locations/IPs: Configure alerts for these.
MFA failed or bypassed: Monitor for high numbers of failed MFA attempts.
Anomalous login patterns: Sign-ins at unusual times or from unusual operating systems/browsers.

Implement Alerting and Automation

Manual review of logs is insufficient. Set up automated alerts for critical activities:

New inbox rules forwarding mail externally.
Impossible travel events.
Multiple failed MFA attempts for a single user.
Changes to global administrator roles.
Application consent grants with high privileges.

Consider using Microsoft Sentinel or a third-party SIEM to correlate these alerts and automate response actions.

User Education and Reporting

Your users are often the first line of defense. Train them to recognize and report suspicious activity:

Unexplained MFA prompts.
Emails missing from their inbox or sent items.
Changes to their email signature or out-of-office messages they didn't make.
Difficulty logging in or unexpected password reset requests.

What is the incident response plan for an ATO?

A swift and coordinated response is critical to contain the damage from an ATO. Here’s a prioritized plan:

Isolate the Account: Immediately disable the compromised user account or force a password reset and revoke all active sessions. If available, block the suspicious IP address at your firewall or conditional access policies.
Investigate Scope and Method: Determine how the account was compromised (phishing, brute force, credential stuffing). Analyze audit logs for the period leading up to and during the compromise. Identify what the attacker accessed, modified, or sent. Check for new inbox rules, application consent grants, or mailbox delegates.
Contain Lateral Movement: If the attacker used the account to send internal phishing emails, identify and quarantine those messages. Check for other compromised accounts. Review logs for any access to sensitive systems or data from the compromised account.
Remediate and Restore: Remove any malicious inbox rules, revoked unauthorized application consent grants, and delete any unauthorized mailbox delegates. Ensure the user's workstation is clean of malware. Restore any deleted or modified data if necessary.
Communicate and Educate: Inform relevant stakeholders about the incident. Provide the affected user with a secure way to reset their password and guide them through checking for further suspicious activity. Reinforce security best practices, including MFA and phishing awareness.
Post-Incident Review: Conduct a thorough review to understand the root cause, identify detection and response gaps, and implement preventative measures to reduce the likelihood of recurrence. Update security policies and training materials accordingly.

How Lion Group helps with Account Takeover Detection and Response

Lion Group understands the critical need for advanced protection against email account takeover. Our solutions, including behavioral email security, provide API-integrated, inbox-level detection that learns normal sender relationships and communication patterns. This allows us to identify unusual payment requests, executive impersonation, vendor email compromise, and conversation hijacking, even when SPF, DKIM and DMARC records pass and no malicious payload is present. We help detect and remediate threats across both internal and external messages, providing automated mailbox-wide remediation and simple employee reporting mechanisms to stop ATOs before they escalate.

Detecting Email Account Takeover in Microsoft 365: A CISO's Guide