Office365 ActiveSync Username Enumeration
Tags
maec-delivery-vectors: Watering Hole
attack-pattern: Data Authentication Attempt - T1381 Credentials - T1589.001 Domain Account - T1087.002 Domain Account - T1136.002 Phishing - T1660 Phishing - T1566 Python - T1059.006 Server - T1583.004 Server - T1584.004 Sharepoint - T1213.002 Tool - T1588.002 Connection Proxy - T1090
Show in Graph
Common Information
Type Value
UUID b2382962-268e-42c3-aaf4-4d6dea57f482
Fingerprint afd129127c5204d5
Analysis status DONE
Considered CTI value 0
Text language
Published July 24, 2017, 3:51 p.m.
Added to db Sept. 26, 2022, 9:31 a.m.
Last updated Nov. 17, 2024, 10:40 p.m.
Headline Sidebar
Title Office365 ActiveSync Username Enumeration
Detected Hints/Tags/Attributes 36/2/28
Source URLs
Redirection Url
Details Source https://grimhacker.com/2017/07/24/office365-activesync-username-enumeration/
URL Provider
Details Provider Source level domain
Details grimhacker.com grimhacker.com
Attributes
Details Type #Events CTI Value
Details Domain 78 
bitbucket.org
Details Domain 212 
technet.microsoft.com
Details Domain 26 
outlook.office365.com
Details Domain 1 
mobilitydojo.net
Details Domain 21 
contoso.com
Details Domain 1 
lo1p123cu001.internal.outlook.com
Details Domain 1 
lo1p123ca0018.gbrp123.prod.outlook.com
Details Domain 1 
lo1p123mb0899.gbrp123.prod.outlook.com
Details Domain 397 
asp.net
Details Domain 1 
mm1p123mb0842.gbrp123.prod.outlook.com
Details Domain 1 
portal.microsoftonline.com
Details Domain 150 
www.w3.org
Details Domain 19 
vnd.ms
Details Domain 1 
mmxp123cu001.internal.outlook.com
Details Domain 1 
mmxp123ca0005.gbrp123.prod.outlook.com
Details Domain 1 
mmxp123mb0750.gbrp123.prod.outlook.com
Details Domain 369 
microsoft.com
Details Email 1 
valid_user@contoso.com
Details Email 1 
invalid_user@contoso.com
Details Email 8 
secure@microsoft.com
Details File 3 
changepassword.aspx
Details Url 1 
https://bitbucket.org/grimhacker/office365userenum
Details Url 1 
https://technet.microsoft.com/en-us/library/aa995986(v=exchg.65).aspx
Details Url 3 
https://outlook.office365.com
Details Url 1 
http://mobilitydojo.net/2010/03/17/digging-into-the-exchange-activesync-protocol
Details Url 1 
https://portal.microsoftonline.com/changepassword.aspx
Details Url 8 
http://www.w3.org/tr/xhtml1/dtd/xhtml1-strict.dtd
Details Url 21 
http://www.w3.org/1999/xhtml