421. Threat Actors Abuse Power BI to Bypass Defenses
Hello everyone! Today, we're once again going to talk about legitimate services, this time in the context of attackers setting up their infrastructure using the Acquire Infrastructure: Web Services (T1583.006) technique. In this case, the attackers leveraged Microsoft Power BI. They used the service to create dashboards containing embedded phishing links. The link in the email looked like this: hxxps[://]app.powerbi[.]com/view?r=eyJrIjoiNTk0NmViNDktYzM1Yy00MjEwLTkyZTctNGU5ZTJmYzMzYjEwIiwidCI6IjU1YTI4YmU2LTFiYzQtNDIzMS05MTA0LTdkMmFlYTVmMGZhNiJ9 Since the link pointed to a legitimate service, emails containing such links could easily bypass security controls. Moreover, the use of a trusted service made the message appear more credible to potential victims. Naturally, especially in environments where this service is not actively used, access to it can be a good candidate for threat hunting: event_type: "dnsreqwin" AND dns_rname: "powerbi.com" See you soon!