Sweet Deception: Deploying Honeypots and Honey Tokens in Microsoft 365

Sweet Deception: Deploying Honeypots and Honey Tokens in Microsoft 365

Speakers: Ryan O'Donnell, Senior Offensive Security Engineer at Microsoft

Conference: SAINTCON

YouTube: https://www.youtube.com/watch?v=pT3WlY_MyEs

Overview

In an era where cyber threats increasingly target cloud environments, Ryan O'Donnell's SAINTCON talk, "Sweet Deception: Deploying Honeypots and Honey Tokens in Microsoft 365," offers a compelling strategy for proactive defense. O'Donnell, a Senior Offensive Security Engineer at Microsoft, highlights the significant shift in attacker methodologies, moving away from traditional endpoint compromises to focus on cloud-native intrusions. His research introduces an innovative approach to deploying Canary tokens within Microsoft 365, specifically targeting Outlook, to provide high-fidelity, early detection of post-compromise activity.

The talk underscores the critical need for defenders to adapt to this evolving threat landscape. With cloud intrusions surging by 136% in the first half of the year alone, and 81% of these being malware-free, traditional endpoint detection and response (EDR) solutions often fall short. O'Donnell's work focuses on leveraging deception techniques to catch adversaries early in their attack chain, significantly reducing their operational dwell time and mitigating potential damage by enabling organizations to shift from external to internal breach detection.

This article delves into O'Donnell's methodology for creating and deploying a novel type of Outlook Canary token that avoids the common pitfall of relying on clickable links. By utilizing hidden inbox folders and monitoring specific Unified Audit Log (UAL) events, he demonstrates a robust, non-invasive, and highly effective detection mechanism. The insights gained from a real-world pilot deployment not only validate the technique's efficacy against external threats but also reveal its unexpected utility in detecting insider risk, making it a valuable addition to any organization's security posture.

Background

▶ Watch: Introduction and talk overview (0:00)

The modern cyber threat landscape has undergone a profound transformation, with attackers increasingly abandoning endpoint-centric strategies in favor of cloud environments. This paradigm shift is driven by several factors, including the widespread adoption of cloud services like Microsoft 365 and the growing sophistication of threat actors in evading traditional endpoint security measures. As Ryan O'Donnell notes, attackers are now "staying up in the cloud, avoiding endpoints, and still achieving all of their objectives." This trend is not merely anecdotal; a CrowdStrike report cited in the talk reveals a staggering 136% increase in cloud intrusions in the first half of the year compared to the entirety of the previous year, with 81% of these intrusions being malware-free. This data unequivocally highlights the urgent need for defenders to adjust their strategies to account for cloud-native attacks.

Within this context, cyber deception emerges as a critical defense mechanism. O'Donnell distinguishes between two primary tools in this domain: honeypots and Canary tokens. Honeypots are generally larger, decoy systems—such as servers or virtual machines—designed to mimic legitimate infrastructure. Their purpose is to lure attackers, log their interactions, and gather threat intelligence. In contrast, Canary tokens are more discrete pieces of data—like credentials, API keys, or documents—whose sole function is to act as tripwires. When an attacker interacts with a Canary token, it triggers an alert, providing early detection. O'Donnell emphasizes Canary tokens for their ability to provide "effective early alerting on attacker post-compromise activity," particularly in cloud environments.

The importance of early detection is underscored by Mandiant's report on global detection by source, which O'Donnell references. The report categorizes breach discovery into internal, external, and adversary-notified (e.g., ransomware). While 43% of breaches are discovered internally (ideal), an equal 43% are discovered externally by third parties like law enforcement or cybersecurity vendors. A concerning 14% are discovered only when the adversary notifies the victim, typically through ransomware demands. Crucially, the dwell time—the period an attacker operates undetected after initial access—varies significantly based on the detection source. The median dwell time is 11 days, but external detection leads to a 16-day longer dwell time compared to internal detection. This stark difference highlights that early, internal detection is paramount to reducing the impact of a breach and giving organizations a "fighting chance."

Given that attackers are increasingly targeting cloud services, specifically Microsoft 365, O'Donnell argues that email and productivity suites are the "crown jewels" of an organization. Threat intelligence, including blogs on groups like Storm-2372 and Void Blizzard, consistently shows attackers using APIs like the Graph API and Exchange Online API to search through emails, file attachments, and shared mailboxes for sensitive information such as passwords, admin credentials, financial data, payment information, and details about remote monitoring and management (RMM) tools. Therefore, deploying Canary tokens specifically within Outlook and other M365 services aligns with attacker methodologies, making them highly attractive targets.

O'Donnell outlines three key criteria for successful Canary token deployment:

1. Attractive: The token must be something attackers will actively enumerate and seek out, otherwise, it will never be triggered.
2. High Fidelity: Alerts must be genuine true positives, minimizing false positives that lead to alert fatigue, especially for small to medium-sized businesses with limited security personnel. This was a primary focus of his testing.
3. Non-invasive: The deployment should not be destructive to the environment or distracting to legitimate users, as tokens are placed among real assets.

By focusing on these principles and understanding the attacker's shift to cloud-based operations, O'Donnell set out to design a novel Outlook Canary token that could effectively meet the demands of modern cloud security.

Key Findings

▶ Watch: Why cloud canary tokens are crucial for early alerting (3:30)

Ryan O'Donnell's research yielded several key findings that significantly advance the application of deception techniques in Microsoft 365 environments:

Firstly, the talk empirically confirms that attackers, particularly those operating in cloud environments, consistently prioritize the enumeration and exfiltration of sensitive information from email and productivity suites. Threat intelligence from groups like Storm-2372 and Void Blizzard demonstrates a clear pattern of adversaries leveraging APIs such as the Graph API and Exchange Online API to search mailboxes for keywords like "password," "admin," "financial info," "payment information," and "remote monitoring and management tools." This reinforces the notion that email within Microsoft 365 is a critical "crown jewel" for organizations, making it an ideal target for deception.

Secondly, O'Donnell identified a significant limitation in existing Outlook Canary token implementations, such as those offered by Sphinx's free service. These often rely on attackers clicking a link within an email to trigger an alert. This approach introduces an additional step that sophisticated threat actors are likely to avoid, or that may be mitigated by sandboxing technologies, thereby reducing the fidelity and effectiveness of the token. A core finding was the need to develop a link-free Canary token to overcome this hurdle.

Thirdly, the research uncovered the practical utility of hidden inbox folders within Outlook as a foundational component for a link-free Canary token. These folders, whose visibility property can be set via the Graph API (for new folders) or a MAPI editor (for existing folders), are concealed from a user's standard view in both desktop and web applications. Crucially, O'Donnell demonstrated that despite being hidden, the content of emails placed within these folders remains fully searchable through the Outlook GUI, the application itself, and programmatically via the Graph API. This was successfully shown using a well-known post-exploitation toolkit like GraphRunner to search for keywords within a hidden folder.

Fourthly, O'Donnell identified the MailItemsAccessed operation within the Unified Audit Log (UAL) as a high-fidelity mechanism for detecting interaction with Canary emails. While this log is typically high-volume due to constant user interaction with emails, specific events can be filtered using the Internet Message ID, a unique identifier for each email. This operation provides rich contextual data, including the application used for access and a session ID, which is invaluable for subsequent investigations into attacker activity.

Finally, a one-month pilot deployment of this novel Outlook Canary token in a real-world small business environment proved its efficacy. Beyond detecting potential external breaches, the pilot unexpectedly revealed the technique's capability to identify insider risk. An alert triggered by an employee, who had been notified of termination, was found to be conducting unauthorized searches for information prior to losing access. This finding significantly expands the utility of Canary tokens beyond traditional external threat detection, aligning with the principle that "if you can't detect an insider threat reliably, then you can't claim to have a secure environment." The pilot successfully demonstrated a "very clear string of zero access events" for the tokens, validating the high-fidelity nature of the alerts when they did occur.

Technical Deep Dive

▶ Watch: Distinguishing between honeypots and canary tokens (4:00)

The core innovation of Ryan O'Donnell's approach lies in its ability to create a highly attractive, yet discreet, Canary token within Microsoft 365 that sidesteps the inherent limitations of link-based deception. This section details the technical underpinnings of his methodology.

The primary challenge O'Donnell sought to overcome was the reliance on clickable links in many existing Outlook Canary token solutions. As he noted, such reliance introduces extra steps for an attacker and is easily circumvented by more sophisticated threat actors who are "much more judicious about which links they click" or who employ sandboxes. To achieve a link-free detection mechanism, O'Donnell focused on leveraging native Microsoft 365 functionalities that attackers would naturally interact with during their post-compromise reconnaissance.

The foundational building block for this novel Canary token is the concept of hidden inbox folders in Outlook. These are not standard folders but rather regular inbox folders where a specific property has been set to hide them from a user's typical view in both the desktop application and the web interface. O'Donnell explained that a hidden folder can be created in one of two ways:

1. Upon creation: By utilizing the Graph API to set the appropriate property when a new folder is instantiated. This method is suitable for programmatic deployment of new folders.
2. For existing folders: By using a MAPI editor to modify the properties of an already existing folder.

Crucially, O'Donnell discovered that despite being hidden from direct user navigation, the content of emails placed within these hidden folders remains fully searchable. This is a critical insight, as attackers, once they gain initial access, will often use search functionalities to locate sensitive data within mailboxes. He demonstrated this by placing a lure email containing keywords like "credentials" into a hidden folder and then successfully searching for it using GraphRunner, a well-known post-exploitation toolkit designed for interacting with the Graph API. This confirmed that an attacker enumerating an environment via the GUI, the Outlook application, or the Graph API would still trigger the token if their search queries matched the lure's content.

For the detection mechanism, O'Donnell turned to the Unified Audit Log (UAL), Microsoft 365's comprehensive logging system encompassing Outlook, Teams, SharePoint, and other services. Specifically, he focused on the MailItemsAccessed operation. This operation generates an event whenever a user interacts with an email, providing a robust signal for access. While the MailItemsAccessed log is typically high-volume due to constant legitimate user activity, O'Donnell's method leverages a specific, unique identifier: the Internet Message ID of the Canary email. By continuously monitoring the UAL for MailItemsAccessed events associated with the pre-defined Internet Message ID of the lure email, defenders can distinguish legitimate activity from suspicious interaction with the hidden token.

Furthermore, the MailItemsAccessed operation provides valuable contextual data that aids in incident response. Each event includes information about the application used to access the email and a session ID. This data is crucial for investigators to understand the attacker's toolset and trace other actions performed within the same session, enabling a more comprehensive forensic analysis.

Putting these components together, the ad hoc Canary token process designed by O'Donnell involves the following steps:

1. Create a hidden folder: Using either the Graph API or a MAPI editor, a new folder is created within a target mailbox and its hidden property is set.
2. Send a lure email: An email containing attractive keywords (e.g., "password reset," "admin credentials," "financial report," "payment instructions," "RMM access") is crafted and sent to the target mailbox. The choice of keywords should be tailored to what an attacker would typically search for in the organization's context.
3. Move the email to the hidden folder: The lure email is then programmatically moved into the newly created hidden folder.
4. Continuously monitor UAL: An automated process is established to continuously query the Unified Audit Log for MailItemsAccessed events. The query specifically filters for events where the Internet Message ID matches that of the deployed lure email.
5. Alert on access: If an MailItemsAccessed event is detected for the Canary email, an alert is triggered, notifying security personnel of potential unauthorized access or reconnaissance.

This technical design effectively creates a "tripwire" that is attractive to an attacker's typical post-compromise enumeration activities in Microsoft 365, provides high-fidelity alerts by focusing on specific, unique identifiers, and is non-invasive to legitimate user workflows, as the lure is hidden from view.

Demo / Proof of Concept

▶ Watch: The impact of detection source on attacker dwell time (6:00)

To validate the real-world effectiveness and fidelity of his novel Outlook Canary token, Ryan O'Donnell conducted a one-month pilot deployment in a live production environment. This demonstration moved beyond theoretical testing, providing crucial insights into how the deception technique performs under actual operational conditions.

The environment chosen for the pilot was a small business owned by a friend, which O'Donnell described as cloud-native, with no significant on-premise Active Directory infrastructure. The company comprised a mix of engineers and salespeople, representing a typical modern business profile. Outlook Canaries, implemented using the process detailed in the technical deep dive (hidden folders, lure emails, UAL monitoring), were deployed for a subset of these users. The goal was to assess the fidelity of the alerts and gain practical experience with the system.

The results of the one-month trial were presented graphically, showing the number of MailItemsAccessed events over time. Several key observations emerged:

• Initial Deployment Activity: The graph showed an expected peak in events during the initial deployment phase. This was attributed to O'Donnell himself creating the emails, moving them into hidden folders, and performing initial setup actions. These events were considered benign and part of the setup process.
• Residual Syncing Events: On day 4 and day 6, single access events were recorded. Upon investigation, these were identified as "lagging residual events" related to email syncing across different user devices (laptops, workstations, phones, tablets). O'Donnell noted that he had planned for a one-week buffer to accommodate such initial syncing and normalization, and these events fell within that expected period. They were ultimately deemed non-incidental, highlighting the importance of an initial normalization phase for practical deployments.
• Period of Zero Access: Crucially, following the initial setup and syncing, there was a "very clear string of zero access events," which was the desired outcome. This demonstrated the high fidelity of the Canary, indicating that legitimate users were not inadvertently triggering the tokens, thus avoiding alert fatigue.
• Day 13 Alert and Insider Threat Detection: The most significant and unexpected finding occurred on day 13, when a distinct spike in access events was observed. O'Donnell received an alert and initiated a thorough investigation, examining the application used, the time of access, and other related session activities, including whether any new inbox rules were created. Despite extensive analysis, he initially "couldn't necessarily rule it out as benign" but also "didn't look suspicious" enough to be a clear external breach.

Upon reaching out to the company's CEO, the true nature of the alert was uncovered: the employee whose account triggered the Canary had been notified of her termination three days prior. Knowing she was about to lose access, she was actively searching through her mailbox for information she believed she would need. During this "additional searching," she encountered and interacted with the Canary Outlook token.

This real-world incident provided a profound additional insight: while initially designed for detecting external breaches in Microsoft 365, the Canary token proved to be an "effective method at detecting insider risk or insider threat activity as well." This expands the utility of O'Donnell's deception technique significantly, addressing a critical and often challenging area of cybersecurity. The pilot successfully demonstrated that a link-free, UAL-monitored Canary token is not only feasible but also highly effective and capable of providing actionable intelligence in diverse threat scenarios.

Defensive Implications

▶ Watch: Key criteria for effective canary token deployment (8:00)

The deployment of Canary tokens in Microsoft 365, as demonstrated by Ryan O'Donnell, offers profound implications for enhancing an organization's defensive posture, particularly in the cloud-centric threat landscape.

First and foremost, this approach directly addresses the critical issue of attacker dwell time. By shifting detection from external sources to internal, high-fidelity alerts, organizations can significantly reduce the window of opportunity for adversaries. The Mandiant report highlighted a 16-day difference in dwell time between external and internal detection. Implementing O'Donnell's Canary tokens allows defenders to gain early visibility into post-compromise activity, potentially turning a multi-week incident into a much shorter, less impactful event. This proactive stance is vital for mitigating damage and improving incident response capabilities.

The primary defensive action is to implement active deception within the Microsoft 365 environment. This means strategically deploying Canary tokens in locations and with content that mimics what an attacker would actively seek. For Outlook, this involves:

• Crafting attractive lure emails: These should contain keywords that mirror typical attacker reconnaissance targets, such as "credentials," "password," "admin," "financial info," "payment information," or references to "remote monitoring and management tools." The content should be tailored to the specific organization to maximize its allure.
• Utilizing hidden inbox folders: Defenders should leverage the Graph API or MAPI editor to create these concealed folders. This ensures the tokens are not visible to legitimate users, maintaining the non-invasive nature of the deployment and preventing accidental triggers or user distraction.
• Implementing robust UAL monitoring: Continuous monitoring of the Unified Audit Log (UAL) for MailItemsAccessed events, specifically filtered by the Internet Message ID of the Canary emails, is essential. Security teams need to establish alerting mechanisms that trigger immediate notifications upon detection of these specific events. The rich context provided by the MailItemsAccessed event (application, session ID) is invaluable for rapid investigation.

Beyond external threat detection, O'Donnell's pilot demonstrated the significant potential for insider threat detection. This adds an invaluable layer of security, as insider threats can be notoriously difficult to detect through traditional means. Organizations should consider deploying these tokens not just for external breach scenarios but also as a component of their insider risk management program. This could involve placing tokens in areas that would only be accessed by an insider seeking unauthorized information.

For organizations, particularly small to medium-sized businesses (SMBs) with limited security personnel, this method offers a cost-effective early warning system. Unlike complex EDR solutions that may generate significant alert fatigue, O'Donnell's approach focuses on high-fidelity alerts, minimizing the need for extensive manual review and allowing lean security teams to focus on genuine threats.

Defenders should also consider the operational aspects of deployment:

• Automation: Automating the creation of hidden folders, deployment of lure emails, and the continuous UAL monitoring and alerting process will ensure scalability and consistency.
• Normalization Period: Account for an initial normalization period (e.g., one week) after deployment to filter out residual syncing events and avoid false positives, as observed in the pilot.
• Broader M365 Deception: O'Donnell's mention of working on Teams Canaries and SharePoint Canaries indicates a future direction for extending this deception strategy across the entire Microsoft 365 suite, providing even broader coverage.

In essence, O'Donnell's work provides a clear blueprint for shifting from a purely reactive security posture to a more proactive, deception-based defense. By strategically planting these digital tripwires in the cloud environments where attackers are increasingly operating, organizations can gain a crucial advantage, detecting threats earlier and significantly reducing their overall impact.

Key Takeaways

• Cloud is the New Battlefield: Modern attackers are increasingly targeting cloud environments like Microsoft 365, with 136% growth in cloud intrusions and 81% being malware-free, making traditional endpoint security less effective.
• Canary Tokens for Early Detection: Deploying Canary tokens in Microsoft 365 provides high-fidelity, early detection for post-compromise activity, crucial for reducing attacker dwell time and mitigating damage.
• Link-Free Deception is Key: A novel approach using hidden inbox folders in Outlook, combined with monitoring the MailItemsAccessed operation in the Unified Audit Log (UAL) via Internet Message ID, offers a robust, link-free detection method that bypasses sophisticated attacker evasion techniques.
• Beyond External Breaches: Insider Threat Detection: The pilot deployment unexpectedly revealed the technique's effectiveness in detecting insider risk, demonstrating its dual utility for both external breach and internal threat detection.
• High-Fidelity, Non-Invasive Deployment: Successful Canary token deployment requires tokens to be attractive to attackers, generate high-fidelity alerts to avoid alert fatigue, and be non-invasive to legitimate user workflows.
• Actionable Defensive Strategy: Defenders should focus on crafting attractive lure emails, programmatically deploying hidden folders, and implementing continuous, filtered UAL monitoring to proactively detect and respond to threats in Microsoft 365.

About the Speaker(s)

Ryan O'Donnell is a Senior Offensive Security Engineer at Microsoft, bringing a wealth of experience from both offensive and defensive cybersecurity roles. His current work primarily involves penetration testing and purple teaming within cloud environments, reflecting the industry's shift towards cloud-centric security challenges. Prior to his current role, O'Donnell served as a red teamer, developing expertise in simulating advanced persistent threats. He began his career on the defensive side, specializing in digital forensics, which provides him with a comprehensive understanding of attacker methodologies and defensive strategies. Additionally, Ryan O'Donnell is the co-founder of Vortacity, a consulting firm, further showcasing his entrepreneurial spirit and dedication to cybersecurity innovation.