azcomputerguru/claudetools
1
0
Fork 0
Code Issues 58 Pull Requests Actions Packages Projects Releases Wiki Activity
Files
8d2ca14caca814826f4e890126aa5ac26e66f3e9
claudetools/clients/valleywide/session-logs/2026-07/2026-07-16-winter-orders-breach-check-remediation.md
Winter Williams 7db991b037 sync: auto-sync from GURU-BEAST-ROG at 2026-07-16 11:01:29 
Author: Mike Swanson
Machine: GURU-BEAST-ROG
Timestamp: 2026-07-16 11:01:29
2026-07-16 11:02:18 -07:00

11 KiB
Raw Blame History

VWP — Orders@ Breach Check + Remediation, Syncro #32557 + Billing

User

  • Executed by: ClaudeTools Discord Bot (GURU-BEAST-ROG)
  • Requested by: Winter Williams (@winterguru, via Discord) - tech
  • Role: automation (acting on the requester's behalf)

Session Summary

Winter requested a security check on Orders@valleywideplastering.com via Discord (#tech-department, thread 1527356833902362654). Ran the remediation-tool workflow: consent audit (grade AMBER — three apps with partial grants), then full user-breach-check via Security Investigator + Investigator-EXO tiers.

Found a confirmed AiTM token-theft compromise from 2026-07-02 17:20 UTC: interactive sign-in from datacenter IP 172.245.92.208 (ColoCrossing) to Microsoft Intune Enrollment via Authentication Broker, with "MFA requirement satisfied by claim in the token" (replayed stolen session token — CA MFA passed on the stolen claim). 40 seconds later the attacker registered Entra device DESKTOP-YQL6X9KX to the account (persistence). The "Block Sign-ins Outside US" CA policy did not fire because the proxy IP geolocates to Los Angeles. Directory audits showed a prior partial remediation on 2026-07-06 (~16:33-16:40 UTC): two password resets + StsRefreshTokenValidFrom bumps via ComputerGuru Tenant Admin, MFA info updated 16:45. The mailbox itself was clean: 0 inbox rules (incl. hidden), no forwarding, no non-SELF delegations/SendAs, 0 OAuth grants, sent/deleted items normal. Auth methods all predate the incident (Authenticator iPhone 11; WHfB from 2025-06-24).

The rogue device DESKTOP-YQL6X9KX was still registered and ENABLED 14 days later. With Winter's explicit YES: deleted the device via tenant-admin tier (HTTP 204, verified only legit device ORDERSTY remains) and re-revoked all sessions via user-manager tier (HTTP 200). Tenant-wide sign-in sweep for 172.245.92.208 (30d): only orders@ was touched — no lateral spread. Full report written to clients/valleywide/reports/2026-07-16-orders-breach-check.md.

Created Syncro ticket #32557 for Valley Wide Plastering Inc (customer 31694734) via /syncro with Winter's API key (attribution), status Resolved, priority 1 High, assigned Winter (1737), Initial Issue comment customer-emailed at Winter's direction (Do Not Email = no). Billed 0.5 hrs Labor - Remote Business (product 1190473, $150/hr): VWP is prepaid — block went 16.25 → 15.75 hrs, invoice #68050 total $0.00 with note "Block hours remaining: 15.75.", ticket marked Invoiced. Bot alerts posted to #bot-alerts for both writes.

Key Decisions

  • Used investigator/investigator-exo tiers for all reads; escalated to tenant-admin only for the device DELETE and user-manager for the session revoke (minimum privilege).
  • Deleted (not just disabled) the rogue device after Winter's explicit YES — it had never signed in since registration and had no legitimate claim.
  • Re-revoked sessions after device deletion even though a 7/6 revoke existed (belt-and-suspenders — device registration postdated nothing, but revoke is free).
  • Judged the script's "non-US: 1" flag a false positive (a 500142 event from the office IP with no geo populated); the real finding was the US-datacenter IP that geo checks cannot catch.
  • Judged the 7x 50126 failures on 7/6 benign: office-IP retries of the old password during the admin reset window.
  • Initial Issue comment posted with do_not_email: false at Winter's explicit instruction (customer gets notified).
  • Billed with the delivery-channel product (1190473 remote) per prepaid rules — NOT 9269129; verified block decrement post-invoice.

Problems Encountered

  • riskyUser endpoint returned 403 — Security Investigator consent on this tenant is PARTIAL (missing User.Read.All, Sites.Read.All). Documented re-consent URL in the report; not blocking.
  • Consent audit AMBER: investigator, exchange-op, user-manager all have stale partial grants. Re-consent links in the report's Gaps section.

Configuration Changes

  • Created: clients/valleywide/reports/2026-07-16-orders-breach-check.md (full breach report)
  • Created: this session log
  • M365 tenant (5c53ae9f-7071-4248-b834-8685b646450f): deleted Entra device object 575e7b36-8ec1-46df-b66b-c0228ca93c64 (DESKTOP-YQL6X9KX, deviceId 850e5a7e-c7bb-4d65-9bc4-740e11a61ebc); revoked sign-in sessions for user 3739c527-f156-49b7-8779-a19033564a0f

Credentials & Secrets

  • None created or discovered. Vault paths used (app certs auto-resolved by get-token.sh): msp-tools/computerguru-security-investigator.sops.yaml, msp-tools/computerguru-exchange-operator.sops.yaml (via investigator-exo), msp-tools/computerguru-user-manager.sops.yaml, msp-tools/computerguru-tenant-admin.sops.yaml; msp-tools/syncro-winter (Syncro attribution).

Infrastructure & Servers

  • Tenant: valleywideplastering.com = 5c53ae9f-7071-4248-b834-8685b646450f
  • Target user: Orders@valleywideplastering.com = 3739c527-f156-49b7-8779-a19033564a0f
  • Attacker IP: 172.245.92.208 (ColoCrossing datacenter, geolocates Los Angeles)
  • Office egress IP: 4.18.160.106 (geolocates Leesburg; 124/127 sign-ins)
  • Legit device: ORDERSTY (registered 2025-04-08); rogue device: DESKTOP-YQL6X9KX (registered 2026-07-02 17:21:00Z, deleted 2026-07-16)
  • Syncro customer: Valley Wide Plastering Inc (VWP) = 31694734, prepaid block

Commands & Outputs

  • bash scripts/consent-audit.sh valleywideplastering.com → GRADE: AMBER (investigator, exchange-op, user-manager partial)
  • bash scripts/user-breach-check.sh valleywideplastering.com Orders@valleywideplastering.com → artifacts at /tmp/remediation-tool/5c53ae9f-7071-4248-b834-8685b646450f/user-breach/Orders_valleywideplastering_com/
  • DELETE /v1.0/devices/575e7b36-8ec1-46df-b66b-c0228ca93c64 (tenant-admin) → HTTP 204
  • POST /v1.0/users/3739c527-f156-49b7-8779-a19033564a0f/revokeSignInSessions (user-manager) → HTTP 200 value=true
  • GET /auditLogs/signIns?$filter=ipAddress eq '172.245.92.208' → only the two orders@ events on 2026-07-02
  • Syncro: POST /tickets → id 113912233 (#32557); comment 424044507 (Initial Issue), comment 424044987 (Resolution); line item 43297806 (0.5h @ $150); POST /invoices → 1651071811 (#68050, $0.00); PUT invoice note; PUT status Invoiced

Pending / Incomplete Tasks

  • Re-consent the three AMBER apps on the VWP tenant (any Global Admin; URLs in the report Gaps section) — enables Identity Protection risk reads.
  • Discuss phishing-resistant MFA / token-protection CA for VWP with Mike — geo-block CA did not stop the US-datacenter AiTM proxy.
  • Client user awareness: orders@ operator was likely phished ~Jul 2.

Reference Information

  • Report: clients/valleywide/reports/2026-07-16-orders-breach-check.md
  • Syncro ticket: #32557 → https://computerguru.syncromsp.com/tickets/113912233
  • Syncro invoice: #68050 (id 1651071811), $0.00, applied 0.5 prepay hrs; block 16.25 → 15.75
  • Discord thread: 1527356833902362654 (#tech-department)
  • Bot alerts: message_ids 1527360784940798073 (ticket create), 1527361632278286386 (billing)
  • Raw artifacts: /tmp/remediation-tool/5c53ae9f-7071-4248-b834-8685b646450f/user-breach/Orders_valleywideplastering_com/
  • Prior related log: clients/valleywide/reports/2026-06-29-offboarding-teresa-carpio.md

Update: 10:25 AZ — Tenant-wide sweep + ticket update

Winter asked whether other mailboxes showed similar activity. Ran tenant-sweep.sh (30d, all 36 enabled users): device-join fingerprint (Auth Broker -> Intune Enrollment/Device Registration) appears ONLY on the orders@ 7/2 event — all other device registrations came from office IP 4.18.160.106 or known AZ IPs (7/14 DESKTOP-2R13CC4 by j-r@ = legit, office IP). Zero successful non-US sign-ins tenant-wide (658 rows, complete). Ongoing password spray, ALL FAILED: rose@ 74+ x 50053 lockouts (CA,CN,DE,JP,NG,NL,SE), estimating@ 6, guest jr@casarica.net 6, jesse@/ryan@/j-r@ 2 ea (50126/50053) — none reached MFA stage, no correct passwords. Failed-signin data capped at 999 rows (counts are floors). rose@ had zero successful sign-ins in 30d — spray got nothing.

Posted customer-visible comment (id 424048380, email ON per Winter) to #32557 summarizing sweep results. Bot alert 1527364806699516016. Friction logged: comment POST response failed jq parse despite tr strip; comment had posted — GET-verify-first rule prevented a duplicate. Sweep artifacts: /tmp/remediation-tool/5c53ae9f-7071-4248-b834-8685b646450f/sweep/

Update: 11:05 AZ — Mike follow-ups: mailbox access, CA hardening (report-only), 7/23 todo

Mike joined the thread (tagged by Winter). Actions on his direction:

  1. Shelly -> Teresa mailbox FullAccess (Mike request): Add-MailboxPermission via Exchange Operator (cert auth, EXO adminapi InvokeCommand) — teresa@valleywideplastering.com granted FullAccess to shelly@valleywideplastering.com, InheritanceType All, automapping default (on). Verified via Get-MailboxPermission: rights=FullAccess valid=true. Ties to Teresa Carpio offboarding (6/29).

  2. CA state verified: MFA already enforced tenant-wide (7 enabled policies incl. "Require multifactor authentication for all users" — the 7/2 attacker satisfied it with the replayed token claim). MFA registration gaps: 9 accounts (shared mailboxes payroll@, insurance@, faxinbox@, spro@, customerservice@ + billing@ onmicrosoft, +3 EXT guests).

  3. Four CA policies created in REPORT-ONLY (Mike: "all in report only - todo in one week to enforce"), all state=enabledForReportingButNotEnforced, break-glass exclusion sysadmin@ (41810f2d-b674-47ee-9b6f-f3ba69a7703d) on the All-user ones:

    • b85ba64b-4fea-4ad2-b372-644b0c92adaa — ACG Report-only - Require compliant or registered device (All users/apps, grant compliantDevice OR domainJoinedDevice)
    • cf2d4096-e361-4494-840d-5c491a00310c — ACG Report-only - Sign-in frequency 12 hours (session control)
    • d0dd6b43-572b-4ddf-953f-89c5679bdf7f — ACG Report-only - Phishing-resistant MFA (auth strength 00000000-0000-0000-0000-000000000004)
    • 1b65a18a-a4cc-4963-a282-3761fcb89d98 — ACG Report-only - Block shared mailbox interactive sign-in (6 shared accounts: customerservice/faxinbox/payroll/spro/billing-onmicrosoft/insurance)

  4. 7/23 enforcement review scheduled: local one-shot cron e7d69dc8 (BEAST discord-bot, 09:23 AZ 7/23 — session-only, dies on service restart) + durable coord todo 3add67b9-38a9-4ebf-9d0e-534875c90b78 (project valleywide, user mike) as backstop. Review = analyze 7d of sign-ins for reportOnlyFailure per policy, post to Discord thread 1527356833902362654, tag Mike for per-policy go/no-go. NOTE: policy 3 (phishing-resistant) will report-fail for everyone (no FIDO2/WHfB-CA registered); policy 1 impact depends on device registration coverage. Do NOT enforce without Mike's explicit per-policy confirmation.

Reference in New Issue View Git Blame Copy Permalink