A Geofenced Credential-Phishing Link That Sandboxes Clean
Fabrikam Legal has 2,400 users on Exchange Online Protection with Defender for Office 365 Plan 2. Over 11 days, 38 users receive emails from a lookalike domain, fabrikam-legal[.]com, with the display name of the managing partner. Messages have no attachment, pass SPF and DKIM for the lookalike domain, and contain a link to a SharePoint-looking page hosted on a legitimate cloud form service. The link only serves the phishing page when the request comes from the recipient's country and a desktop browser; automated sandbox detonation from another region gets a benign 404. Four users entered credentials; one mailbox then created an inbox rule moving finance messages to RSS Feeds. The tenant's Safe Links policy is in audit-only mode for internal senders, and the allowed domains list includes the cloud form service because marketing uses it. The SOC asks why the messages were delivered and what to change first.
1. Diagnose the delivery path and explain why each existing control failed.
Read the worked answer
Delivery was possible because the message was authentic for the attacker's domain. SPF and DKIM passed for fabrikam-legal.com, and if that domain publishes DMARC, it passes DMARC too; DMARC protects the domain in From, not the display name. The lookalike domain is not the tenant's domain, so the tenant's DMARC record has no effect.
Control by control:
- Impersonation protection: likely not enabled for display names or the protected user list; impersonation insight may not block first contact.
- Safe Links: the policy is in audit-only mode, so clicks were logged but not blocked, and the tenant allow list for the cloud form service overrode URL reputation.
- Sandbox detonation: the URL served benign content to a datacenter IP in another region, so detonation returned clean. This is a geofenced or cloaked page.
- Attachment sandboxing: irrelevant; there was no attachment.
- Mailbox rule: once credentials were stolen, the attacker created a rule that hid vendor replies. No alert fired on rule creation.
The first failure is policy mode, then over-broad allow listing, then lack of impersonation protection, then no detection of suspicious inbox rules.
2. What immediate containment and tuning changes would you make, in priority order?
Read the worked answer
Priority order:
- Contain the four compromised accounts: revoke sessions and refresh tokens, reset passwords, remove attacker-created inbox rules, check for MFA changes, delegate access, and OAuth consent grants.
- Block fabrikam-legal.com and the specific cloud form URL at the tenant; search for all recipients and clicks; purge messages.
- Remove the broad allow entry for the cloud form service or scope it to specific URLs and senders used by marketing. Allow lists are a common bypass.
- Move Safe Links from audit-only to block mode for all users, including internal senders; enable time-of-click and URL rewrite.
- Enable impersonation protection for the managing partner and other executives; add a mail flow rule to prepend an external sender warning and to flag display-name matches.
- Notify affected users, require credential reset, and review sign-in logs for the attacker IP.
Do not start by blocking the entire cloud form service; marketing depends on it. Scope the exception, then enforce the control.
3. How would you design detection for future geofenced or time-delayed links?
Read the worked answer
Design for time-of-click and real-user context rather than relying only on pre-delivery detonation. Practical controls:
- Safe Links detonation at click time with URL rewrite and block on verdict; this catches pages that change after delivery.
- Detonate from multiple egress regions and browser user agents, and treat a 404 or benign page from a datacenter IP as inconclusive, not clean.
- Use link isolation or a remote browser for first-time or uncategorized sites.
- Alert on click telemetry from users in the targeted geography to uncategorized domains, and on new inbox rules that hide mail.
- Feed user reports into automatic investigation and purge.
No control fully solves geofencing; layering and fast containment matter more than a perfect sandbox verdict.