54 lines
3.2 KiB
Markdown
54 lines
3.2 KiB
Markdown
# Breach Re-Check — megan.hiatt@cascadestucson.com
|
||
|
||
**Date:** 2026-06-30 · **Performed by:** Howard Enos (ClaudeTools session)
|
||
**Tenant:** Cascades of Tucson (cascadestucson.com, `207fa277-e9d8-4eb7-ada1-1064d2221498`)
|
||
**Object ID:** `ab306d53-6d6c-4f8f-a982-f4f571722178`
|
||
**Why:** Megan's account carried a `CREDENTIAL_STUFFING_ACTIVE` marker in the April tenant
|
||
inventory. This re-check verifies whether the April remediation held and whether the campaign is
|
||
still active. Read-only; no actions taken.
|
||
|
||
## Verdict — CLEAN. April remediation held; attack no longer active.
|
||
|
||
The April credential-stuffing campaign (119 malicious sign-in attempts over 30 days from 7
|
||
EU/UK IPs, all blocked at error 50053) has **ceased**, and the hardening applied in April is
|
||
**still in place**. No compromise indicators.
|
||
|
||
## April remediation — current status (did it hold?)
|
||
|
||
| April control | Current state (2026-06-30) | Held? |
|
||
|---|---|---|
|
||
| Disable SMTP AUTH on Megan's mailbox | `SmtpClientAuthenticationDisabled=true` | **Yes** |
|
||
| Disable IMAP | `ImapEnabled=false` | **Yes** |
|
||
| Disable POP | `PopEnabled=false` | **Yes** |
|
||
| Rotate password | Last change `2026-05-28` (post-April; rotated) | **Yes** |
|
||
| MFA = Authenticator (not SMS) | Methods: password + microsoftAuthenticator only; **no SMS**, no new method | **Yes** |
|
||
| Tenant anti-spam / anti-phish hardening (SPF hard-fail, mailbox-intelligence quarantine, first-contact tips) | Applied tenant-wide in April (Default policies) | (tenant-level, unchanged) |
|
||
|
||
EWS / ActiveSync / OWA / MAPI remain enabled — same as April; those are modern-auth capable, not
|
||
basic-auth bypass paths.
|
||
|
||
## Live breach check (10-point) — all clean
|
||
|
||
| # | Check | Result |
|
||
|---|---|---|
|
||
| Sign-ins (30d) | **0 interactive, 0 non-US** (was 119 malicious + 16 US-success in April) | No active attack; no foreign success ever |
|
||
| Account | `accountEnabled=true`, cloud-only | normal |
|
||
| Auth methods | password + Microsoft Authenticator (2) | no new/weak method |
|
||
| Inbox rules | 1 visible + 4 hidden — all benign (Junk default, 2 OOF system, user "Cascade of Tucson" move rule) | no forward/redirect/delete |
|
||
| Mailbox permissions | 0 non-SELF | no delegates |
|
||
| SendAs | 0 non-SELF | none |
|
||
| Forwarding | `ForwardingAddress=null`, `ForwardingSmtpAddress=null` | not forwarding |
|
||
| OAuth grants | 5 — Outlook Mobile ×2, third-party OIDC SSO, Contacts.Read (April set) **+ ALIS SSO SP `e1cae4ad…` User.Read** (expected, June 3 ALIS rollout) | benign |
|
||
| Directory audits (30d) | 0 | no admin tampering |
|
||
| Risk detections | 0 (risky-user read still `Forbidden` — known `IdentityRiskyUser.Read.All` consent gap, not a finding) | — |
|
||
|
||
## Notes
|
||
|
||
- **`CREDENTIAL_STUFFING_ACTIVE` is a stale April marker**, not a live signal — the campaign is no
|
||
longer hitting (0 attempts in 30d). It reflects April state captured in the tenant inventory.
|
||
- The only April recommendation not confirmed implemented is **C1 — Conditional Access US-only
|
||
geo-block** for office users. It is now **optional/low-urgency**: every stuffing attempt was
|
||
already blocked by MFA + MS IP-reputation, and the campaign has stopped. Worth scheduling as
|
||
baseline hardening but not an active risk.
|
||
- Raw artifacts: `/tmp/remediation-tool/207fa277-…/user-breach/megan_hiatt_cascadestucson_com/`.
|