sync: auto-sync from GURU-BEAST-ROG at 2026-07-16 10:11:10
Author: Mike Swanson Machine: GURU-BEAST-ROG Timestamp: 2026-07-16 10:11:10
This commit is contained in:
Winter Williams
@@ -0,0 +1,75 @@
|
||||
# VWP — Orders@ Breach Check + Remediation, Syncro #32557 + Billing
|
||||
|
||||
## User
|
||||
- **Executed by:** ClaudeTools Discord Bot (GURU-BEAST-ROG)
|
||||
- **Requested by:** Winter Williams (@winterguru, via Discord) - tech
|
||||
- **Role:** automation (acting on the requester's behalf)
|
||||
|
||||
## Session Summary
|
||||
|
||||
Winter requested a security check on Orders@valleywideplastering.com via Discord (#tech-department, thread 1527356833902362654). Ran the remediation-tool workflow: consent audit (grade AMBER — three apps with partial grants), then full user-breach-check via Security Investigator + Investigator-EXO tiers.
|
||||
|
||||
Found a confirmed AiTM token-theft compromise from 2026-07-02 17:20 UTC: interactive sign-in from datacenter IP 172.245.92.208 (ColoCrossing) to Microsoft Intune Enrollment via Authentication Broker, with "MFA requirement satisfied by claim in the token" (replayed stolen session token — CA MFA passed on the stolen claim). 40 seconds later the attacker registered Entra device DESKTOP-YQL6X9KX to the account (persistence). The "Block Sign-ins Outside US" CA policy did not fire because the proxy IP geolocates to Los Angeles. Directory audits showed a prior partial remediation on 2026-07-06 (~16:33-16:40 UTC): two password resets + StsRefreshTokenValidFrom bumps via ComputerGuru Tenant Admin, MFA info updated 16:45. The mailbox itself was clean: 0 inbox rules (incl. hidden), no forwarding, no non-SELF delegations/SendAs, 0 OAuth grants, sent/deleted items normal. Auth methods all predate the incident (Authenticator iPhone 11; WHfB from 2025-06-24).
|
||||
|
||||
The rogue device DESKTOP-YQL6X9KX was still registered and ENABLED 14 days later. With Winter's explicit YES: deleted the device via tenant-admin tier (HTTP 204, verified only legit device ORDERSTY remains) and re-revoked all sessions via user-manager tier (HTTP 200). Tenant-wide sign-in sweep for 172.245.92.208 (30d): only orders@ was touched — no lateral spread. Full report written to clients/valleywide/reports/2026-07-16-orders-breach-check.md.
|
||||
|
||||
Created Syncro ticket #32557 for Valley Wide Plastering Inc (customer 31694734) via /syncro with Winter's API key (attribution), status Resolved, priority 1 High, assigned Winter (1737), Initial Issue comment customer-emailed at Winter's direction (Do Not Email = no). Billed 0.5 hrs Labor - Remote Business (product 1190473, $150/hr): VWP is prepaid — block went 16.25 → 15.75 hrs, invoice #68050 total $0.00 with note "Block hours remaining: 15.75.", ticket marked Invoiced. Bot alerts posted to #bot-alerts for both writes.
|
||||
|
||||
## Key Decisions
|
||||
|
||||
- Used investigator/investigator-exo tiers for all reads; escalated to tenant-admin only for the device DELETE and user-manager for the session revoke (minimum privilege).
|
||||
- Deleted (not just disabled) the rogue device after Winter's explicit YES — it had never signed in since registration and had no legitimate claim.
|
||||
- Re-revoked sessions after device deletion even though a 7/6 revoke existed (belt-and-suspenders — device registration postdated nothing, but revoke is free).
|
||||
- Judged the script's "non-US: 1" flag a false positive (a 500142 event from the office IP with no geo populated); the real finding was the US-datacenter IP that geo checks cannot catch.
|
||||
- Judged the 7x 50126 failures on 7/6 benign: office-IP retries of the old password during the admin reset window.
|
||||
- Initial Issue comment posted with do_not_email: false at Winter's explicit instruction (customer gets notified).
|
||||
- Billed with the delivery-channel product (1190473 remote) per prepaid rules — NOT 9269129; verified block decrement post-invoice.
|
||||
|
||||
## Problems Encountered
|
||||
|
||||
- riskyUser endpoint returned 403 — Security Investigator consent on this tenant is PARTIAL (missing User.Read.All, Sites.Read.All). Documented re-consent URL in the report; not blocking.
|
||||
- Consent audit AMBER: investigator, exchange-op, user-manager all have stale partial grants. Re-consent links in the report's Gaps section.
|
||||
|
||||
## Configuration Changes
|
||||
|
||||
- Created: `clients/valleywide/reports/2026-07-16-orders-breach-check.md` (full breach report)
|
||||
- Created: this session log
|
||||
- M365 tenant (5c53ae9f-7071-4248-b834-8685b646450f): deleted Entra device object 575e7b36-8ec1-46df-b66b-c0228ca93c64 (DESKTOP-YQL6X9KX, deviceId 850e5a7e-c7bb-4d65-9bc4-740e11a61ebc); revoked sign-in sessions for user 3739c527-f156-49b7-8779-a19033564a0f
|
||||
|
||||
## Credentials & Secrets
|
||||
|
||||
- None created or discovered. Vault paths used (app certs auto-resolved by get-token.sh): msp-tools/computerguru-security-investigator.sops.yaml, msp-tools/computerguru-exchange-operator.sops.yaml (via investigator-exo), msp-tools/computerguru-user-manager.sops.yaml, msp-tools/computerguru-tenant-admin.sops.yaml; msp-tools/syncro-winter (Syncro attribution).
|
||||
|
||||
## Infrastructure & Servers
|
||||
|
||||
- Tenant: valleywideplastering.com = 5c53ae9f-7071-4248-b834-8685b646450f
|
||||
- Target user: Orders@valleywideplastering.com = 3739c527-f156-49b7-8779-a19033564a0f
|
||||
- Attacker IP: 172.245.92.208 (ColoCrossing datacenter, geolocates Los Angeles)
|
||||
- Office egress IP: 4.18.160.106 (geolocates Leesburg; 124/127 sign-ins)
|
||||
- Legit device: ORDERSTY (registered 2025-04-08); rogue device: DESKTOP-YQL6X9KX (registered 2026-07-02 17:21:00Z, deleted 2026-07-16)
|
||||
- Syncro customer: Valley Wide Plastering Inc (VWP) = 31694734, prepaid block
|
||||
|
||||
## Commands & Outputs
|
||||
|
||||
- `bash scripts/consent-audit.sh valleywideplastering.com` → GRADE: AMBER (investigator, exchange-op, user-manager partial)
|
||||
- `bash scripts/user-breach-check.sh valleywideplastering.com Orders@valleywideplastering.com` → artifacts at /tmp/remediation-tool/5c53ae9f-7071-4248-b834-8685b646450f/user-breach/Orders_valleywideplastering_com/
|
||||
- `DELETE /v1.0/devices/575e7b36-8ec1-46df-b66b-c0228ca93c64` (tenant-admin) → HTTP 204
|
||||
- `POST /v1.0/users/3739c527-f156-49b7-8779-a19033564a0f/revokeSignInSessions` (user-manager) → HTTP 200 value=true
|
||||
- `GET /auditLogs/signIns?$filter=ipAddress eq '172.245.92.208'` → only the two orders@ events on 2026-07-02
|
||||
- Syncro: POST /tickets → id 113912233 (#32557); comment 424044507 (Initial Issue), comment 424044987 (Resolution); line item 43297806 (0.5h @ $150); POST /invoices → 1651071811 (#68050, $0.00); PUT invoice note; PUT status Invoiced
|
||||
|
||||
## Pending / Incomplete Tasks
|
||||
|
||||
- Re-consent the three AMBER apps on the VWP tenant (any Global Admin; URLs in the report Gaps section) — enables Identity Protection risk reads.
|
||||
- Discuss phishing-resistant MFA / token-protection CA for VWP with Mike — geo-block CA did not stop the US-datacenter AiTM proxy.
|
||||
- Client user awareness: orders@ operator was likely phished ~Jul 2.
|
||||
|
||||
## Reference Information
|
||||
|
||||
- Report: clients/valleywide/reports/2026-07-16-orders-breach-check.md
|
||||
- Syncro ticket: #32557 → https://computerguru.syncromsp.com/tickets/113912233
|
||||
- Syncro invoice: #68050 (id 1651071811), $0.00, applied 0.5 prepay hrs; block 16.25 → 15.75
|
||||
- Discord thread: 1527356833902362654 (#tech-department)
|
||||
- Bot alerts: message_ids 1527360784940798073 (ticket create), 1527361632278286386 (billing)
|
||||
- Raw artifacts: /tmp/remediation-tool/5c53ae9f-7071-4248-b834-8685b646450f/user-breach/Orders_valleywideplastering_com/
|
||||
- Prior related log: clients/valleywide/reports/2026-06-29-offboarding-teresa-carpio.md
|
||||
Reference in New Issue
Block a user