Latest articles

Sidestepping SharePoint Security: Two New Techniques to Evade Exfiltration Detection

Eric Saraga

Apr 09, 2024

Varonis Threat Labs discovered two techniques in SharePoint that allow users to circumvent audit logs and avoid triggering download events while exfiltrating files.

Is this SID taken? Varonis Threat Labs Discovers Synthetic SID Injection Attack

Eric Saraga

Mar 11, 2022

A technique where threat actors with existing high privileges can inject synthetic SIDs into an ACL creating backdoors and hidden permission grants.

Using Power Automate for Covert Data Exfiltration in Microsoft 365

Eric Saraga

Feb 02, 2022

How threat actors can use Microsoft Power Automate to automate data exfiltration, C2 communication, lateral movement, and evade DLP solutions.

Using Malicious Azure Apps to Infiltrate a Microsoft 365 Tenant

Eric Saraga

Aug 20, 2020

Phishing remains one of the most successful ways to infiltrate an organization. We’ve seen a massive amount of malware infections stemming from users opening infected attachments or clicking links that...

Azure Skeleton Key: Exploiting Pass-Through Auth to Steal Credentials

Eric Saraga

Apr 22, 2020

We created a proof-of-concept that manipulates the Azure authentication function to give us a ‘skeleton key’ password that will work for all users, and dump all real clear-text usernames and passwords into a file.