Generated by All in One SEO v5.0.0.1, this is an llms.txt file, used by LLMs to index the site.

# Syne's Cyber Corner

A Very Cool and Serious Website

## Sitemaps

- [XML Sitemap](https://cybercorner.tech/sitemap.xml): Contains all public & indexable URLs for this website.

## Posts

- [Malicious Azure Application PERFECTDATA SOFTWARE and Microsoft 365 Business Email Compromise](https://cybercorner.tech/malicious-azure-application-perfectdata-software-and-office365-business-email-compromise/) - Edit 04/13/25: The newest version of the software behind this application has changed. Now, the application's name within a tenant will be Mail_Backup. The app id is now 2ef68ccc-8a4d-42ff-ae88-2d7bb89ad139. Most of the information contained in this article is still accurate. Please view this post for up-to-date IOCs and permissions for this app. If you have
- [PERFECTDATA SOFTWARE Rebrands to Mail_Backup](https://cybercorner.tech/perfectdata-software-rebrands-to-mail_backup/) - The well-known abused Entra ID/Azure AD OAuth application PERFECTDATA SOFTWARE has now been renamed to Mail_Backup. The app ID and associated permissions have also changed. The prior article I wrote about PDS, it's malicious uses, and other important information is still relevant, and if you are currently dealing with an incident involving this application, I
- [Common Oauth Apps Used in Business Email Compromise](https://cybercorner.tech/common-oauth-apps-used-in-business-email-compromise/) - This article serves as another place to document some common (and not so common) Oauth applications that are abused for malicious purposes during a BEC. Some are well documented, while others are rarer, only discussed between responders or detailed on GitHub lists. The places where some of these apps are detailed may only provide a
- [Osprey - An Alternative to the Hawk PowerShell Module for Email Compromise Investigations](https://cybercorner.tech/osprey-an-alternative-to-the-hawk-powershell-module-for-email-compromise-investigations/) - Unfortunately, Hawk is no longer working properly due to the deprecation of the Search-AdminAuditLog cmdlet. The good news is that there is an alternative! Osprey is my fork of Hawk. It has (mostly) fixed the issues with deprecated cmdlets and dependant modules, and has added a truckload of QoL improvements and additional investigation signals. You
- [Syne's Declassified O365 Email Compromise Investigation Guide](https://cybercorner.tech/synes-declassified-o365-email-compromise-investigation-guide/) - AKA newb's guide to investigating an email compromise. (Yes, I did spend 3x the amount of time making that image then I did writing the article, what about it??) Disclaimer This is a guide for those of you who find yourself facing this type of incident for perhaps the first time, or have limited experience.
- [Malicious Usage of eM Client In Business Email Compromise](https://cybercorner.tech/malicious-usage-of-em-client-in-business-email-compromise/) - If you've found your way to this article, it's likely because you have found a suspicious application content for eM Client. This is an application that is similar in it's usage to PERFECTDATA SOFTWARE, but is also distinct. While the exact reason why threat actors use that application is not conclusively known, my examination of
- [Redditor Gets Malware From Vibrator (& Why I think It's a Hoax)](https://cybercorner.tech/redditor-gets-malware-from-vibrator-why-i-think-its-a-hoax/) - One of the stranger malware delivery methods I've heard of, so let's talk about it! On February 16th, 2024, Reddit user VegetableLuck made an interesting (and now deleted) post on the r/malware subreddit, claiming to have found malware when they plugged in a USB vibrator. The post blew up, and though it's veracity has still
- [The Million Dollar CEO Fraud: Anatomy of a Business Email Compromise](https://cybercorner.tech/the-million-dollar-ceo-fraud-anatomy-of-a-business-email-compromise/) - This is the article version of my talk from BSides Edmonton & Calgary 2023. While the actual presentation is probably better, this one can serve as a decent overview. Some Background My name is Damien, and I'm a Security Analyst at an Edmonton & Calgary-based MSP. We're an SMB that serves SMBs, which is important
- [Gripes About Microsoft Expanding Audit Premium Availability](https://cybercorner.tech/gripes-about-microsoft-expanding-audit-premium-availability/) - The last few blog posts I've made have been more informative or educational, but this is my cybercorner so I will post what I want. I mentioned in my last post which was my guide to investigating 365 BEC that I was working on changing my process due to Microsoft expanding Audit Premium (or at
- [Using Shodan to Find HFS Servers and Steal Their Malware](https://cybercorner.tech/using-shodan-to-find-hsf-servers-and-steal-their-malware/) - I remember the first time that I encountered malware. It was 2010, I was 11 years old, and something was wrong with my pink Toshiba Satellite U505. I don't remember exactly what it was, but I remember crying to my dad that something scary was happening. He called my older cousin who worked at a

## Pages

- [Osprey](https://cybercorner.tech/osprey/) - Osprey is a PowerShell module that is used to gather information for investigating Microsoft 365 Business Email Compromise incidents. The module performs limited analysis of the data, but you can pair it with this guide for more guidance on how to do an investigation. Get Started You can install Osprey two ways: Open up a
- [About](https://cybercorner.tech/about/) - I'm Damien (he/him) a late-stage zoomer and cyber dweeb. I work as a security analyst at an MSP, and in my spare time I enjoy painting, baking, video games, and getting into trouble on the internet. I have a special interest in incident response, forensics, and cloud security. I'm blue team by trade, but I

## Categories

- [Incident Response](https://cybercorner.tech/category/incident-response/)
- [Forensics](https://cybercorner.tech/category/forensics/)
- [Office 365](https://cybercorner.tech/category/office365/)
- [Azure AD](https://cybercorner.tech/category/azure-ad/)
- [Shodan](https://cybercorner.tech/category/shodan/)
- [Malware](https://cybercorner.tech/category/malware/)
- [Conferences](https://cybercorner.tech/category/conferences/)
- [Featured](https://cybercorner.tech/category/featured/)

## Tags

- [Business Email Compromise](https://cybercorner.tech/tag/business-email-compromise/)
- [Email Hack](https://cybercorner.tech/tag/email-hack/)
- [em client](https://cybercorner.tech/tag/em-client/)
- [microsoft hack](https://cybercorner.tech/tag/microsoft-hack/)
- [email compromise](https://cybercorner.tech/tag/email-compromise/)
- [hawk](https://cybercorner.tech/tag/hawk/)
- [powershell](https://cybercorner.tech/tag/powershell/)