Blog
/
/
June 7, 2020

How Darktrace AI Identified Microsoft 365 Breaches

Default blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog image
07
Jun 2020
We cover two real cases on how Darktrace stopped Microsoft 365 account takeovers by correlating insights across SaaS applications & email activity.

Social engineering’. ‘Credential theft’. ‘Account takeover’. If you were a fly on the wall of a Security Operations Center in 2020, you would have heard these phrases far more often than ‘banking trojan’, ‘SQL injection’ or ‘exploit kit’. The reason for this is simple – the reality for most security teams now is that their perimeter has shifted into the cloud. Identities are being attacked more than devices.

Microsoft 365 account compromise’ is the current favorite, with 29% of organizations reporting a related incident in one month alone. Security teams struggle with these attacks because the evidence needed to detect them is scattered across the enterprise: they begin via email, are executed over the network, and progress in the cloud. This broad and spread out digital footprint means that following the breadcrumbs is not easy.

Darktrace’s Cyber AI Platform is designed to understand a user’s behavior as they move between devices and cloud services, tracking their activity to identify a compromise. To help understand how these attacks avoid detection, it is useful to look at a couple of examples of Microsoft Office 365 compromise detected recently in one of our customers.

Microsoft 365 compromised to launch external email threat

A Microsoft 365 account was recently compromised at a public accounting firm based in the United States. Darktrace initially picked up on several anomalies, including a sudden surge in outbound email traffic as well as the unusual login location – while the company and nearly all of its users were located in Wisconsin, an IP address located in Kansas was used to log in to the Microsoft 365 account. Along with the unusual login, a login to Microsoft Teams from the same Kansas IP address was detected.

Figure 1: Just after the new email rule was created, a Microsoft Teams 100% rare IP login occurred.

‘Impossible travel’ rules alone would have missed these anomalies, but an understanding of activity and behavior across different SaaS applications allowed Darktrace’s AI to recognize these events as one systematic case of credential theft. When the threat-actor subsequently created a new email rule, Darktrace was able to connect this event with the other anomalous behavior and understand its potentially malicious nature.

Figure 2: Darktrace’s SaaS Module noted a 100% rare IP logging into the user’s Microsoft 365 account and the creation of a new mailbox rules. All factors indicated 100% unusual SaaS activity.

Five minutes later, Antigena Email alerted on a large number of outbound emails containing a generic subject line and an attached PDF. The technology also detected that there was a clear spike in outbound emails from this user and flagged each of these emails with the “Out of Character” tag, which in this case denoted a change from normal behavior with the surge in recipients, and likely internal compromise.

Figure 3: Antigena Email detected a surge in recipients that indicated a serious breach of normal behavior for this user.

The unusual login behavior detected by Darktrace’s SaaS Module could be connected to the anomalous outbound email behavior flagged by Antigena Email, allowing the security team to see the extent of the attack and neutralize it as it emerged. It was clear that the account was being used to engage in malicious activity, as each of the 220 outbound emails used a generic subject line and contained a suspicious attachment. The security team therefore immediately disabled the compromised account.

Figure 4: A recreation of the email sent by the attacker, containing the malicious attachment.

‘Change of bank details’ sent from accounts department

When an Accounts Department’s Microsoft 365 account was compromised and used to send targeted phishing emails, Darktrace was able to track the attacker’s movement within the inbox, tying together information from Darktrace’s SaaS Module with Antigena Email’s alerts to understand the full picture of the threat and stop the attack.

The SaaS account appears to have been compromised via an inbound spear phishing attack, or some other form of attack that occurred before Darktrace began monitoring the organization. While Darktrace Cyber AI had no oversight of the initial compromise, it was still able to distinguish later attacker behavior as malicious, based on its actively evolving understanding of the organization and its workforce.

When the account user logged in from a 100% rare French IP address, Darktrace’s SaaS Module picked up on the anomaly immediately, and further detected a series of activities carried out after the unusual login. At the same time, Antigena Email noted an email being sent.

Figure 5: The login from a French IP was noted as 100% rare for this user and SaaS account.

Darktrace then identified more activity occurring from a second rare login location, a Swiss IP address. Very little email activity occurred when the account was logged in from this IP. Instead, Cyber AI saw the threat-actor using their illegitimate SaaS access to view information on the legitimate account user and files related to banking, invoices, and payments.

Antigena Email then identified a series of email communications that, when seen in the context of the SaaS account compromise, pointed to a clear threat. There were no obvious malicious attachments or links in the emails. However, the subject of the final reply was ‘Change of Bank Details’, and the email prompted a high Solicitation Inducement Score within Antigena Email, strongly implying that the malicious actor had sent emails instructing the destination to change payment details in order to route money to the attacker, instead of the company.

It seems the attackers went through the banking and invoicing files in order to find a customer with a big bill to pay, then used the compromised email account to launch an outbound phishing attack, changing the billing details. With Darktrace AI correlating information within the SaaS platform and insights from Antigena Email, this targeted phishing attack could be contained before further compromise or damage could occur.

The below screenshot also indicates a series of inbox processing rules made on the compromised account, showing actions that are typical of an account takeover.

Figure 6: Darktrace’s records of new inbox rules being set up on the compromised SaaS account.

The benefits of a unified approach

These stories are all too familiar. Most security tools would not be able to take action on any one of these steps individually. But the combination reveals the tell-tale sign of a Microsoft 365 account hijack. Organizations are struggling to manage their user identities across their cloud infrastructure, and rule and policy-based detection is no longer feasible.

However, by learning identities and behavior across the enterprise, Darktrace is able to detect, and seamlessly respond, to combat these threats. Hundreds of organizations are now using Antigena Email to protect their email and cloud environments continuously, trusting it to dynamically enforce MFA, lock accounts, block network traffic, and withhold emails when necessary.

As cloud-native applications become more popular, organizations face the growing problem of separate end-to-end security solutions for each type of workload. With Antigena Email working in conjunction with Darktrace’s Enterprise Immune System, defenders can be assured that a single, unified platform is tracking every suspicious behavior, wherever it arises in the organization.

Learn more about Antigena Email

Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Author
Dan Fein
VP, Product

Based in New York, Dan joined Darktrace’s technical team in 2015, helping customers quickly achieve a complete and granular understanding of Darktrace’s product suite. Dan has a particular focus on Darktrace/Email, ensuring that it is effectively deployed in complex digital environments, and works closely with the development, marketing, sales, and technical teams. Dan holds a Bachelor’s degree in Computer Science from New York University.

Book a 1-1 meeting with one of our experts
Share this article

More in this series

No items found.

Blog

/

OT

/

April 4, 2025

Darktrace Named as Market Leader in the 2025 Omdia Market Radar for OT Cybersecurity Platforms

Default blog imageDefault blog image

We are pleased to announce that Darktrace / OT has been named a Market Leader in Omdia’s  2025 Market Radar for OT Cybersecurity Platforms. We believe this highlights our unique capabilities in the OT security market and follows similar recognition from Gartner who recently named Darktrace / OT as the sole Visionary in in the Magic Quadrant for Cyber Physical Systems (CPS) Protection Platforms market.

Historically, IT and OT systems have been managed separately, creating challenges due to the differences of priorities between the two domains. While both value availability, IT emphasizes confidentiality and integrity whereas OT focuses on safety and reliability. Organizations are increasingly converging these systems to reap the benefits of automation, efficiency, and productivity (1).

Omdia’s research highlights that decision makers are increasingly prioritizing comprehensive security coverage, centralized management, and advanced cybersecurity capabilities when selecting OT security solutions (1).

Rising productivity demands have driven the convergence of OT, IT, and cloud-connected systems, expanding attack surfaces and exposing vulnerabilities. Darktrace / OT provides a comprehensive OT security solution, purpose-built for critical infrastructure, offering visibility across OT, IoT, and IT assets, bespoke risk management, and industry-leading threat detection and response powered by Self-Learning AITM.

Figure 1: Omdia vendor overview for OT cybersecurity platforms
Figure 1: Omdia vendor overview for OT cybersecurity platforms

An AI-first approach to OT security  

Many OT security vendors have integrated AI into their offerings, often leveraging machine learning for anomaly detection and threat response. However, only a few have a deep-rooted history in AI, with longstanding expertise shaping their approach beyond surface-level adoption.

The Omdia Market Radar recognizes that Darktrace has extensive background in the AI space:

“Darktrace has invested extensively in AI research to fuel its capabilities since 2013 with 200-plus patent applications, providing anomaly detection with a significant level of customization, helping with SOC productivity and efficiency, streamlining to show what matters for OT.” (1)

Unlike other security approaches that rely on existing threat data, Darktrace / OT achieves this through Self-Learning AI that understands normal business operations, detecting and containing known and unknown threats autonomously, thereby reducing Sec Ops workload and ensuring minimal downtime

This approach extends to incident investigations where an industry-first Cyber AI AnalystTM automatically investigates all relevant threats across IT and OT, prioritizes critical incidents, and then summarizes findings in an easily understandable view—bringing production engineers and security analysts together to communicate and quickly take appropriate action.

Balancing autonomous response with human oversight

In OT environments where uptime is essential, autonomous response technology can be approached with apprehension. However, Darktrace offers customizable response actions that can be set to “human confirmation mode.”

Omdia recognizes that our approach provides customizable options for autonomous response:

“Darktrace’s autonomous response functionality enforces normal, expected behavior. This can be automated but does not need to be from the beginning, and it can be fine-tuned. Alternative step-by-step mitigations are clearly laid out step-by-step and updated based on organizational risk posture and current level of progress.” (1)

This approach allows security and production to keep humans-in-the-loop with pre-defined actions for potential attacks, enforcing normal to contain a threat, and allowing production to continue without disruption.  

Bespoke vulnerability and risk management

In the realm of OT security, asset management takes precedent as one of the key focus points for organizations. With a large quantity of assets to manage, practitioners are overwhelmed with information with no real way to prioritize or apply them to their unique environment.

Darktrace / OT is recognized by Omdia as having:

“Advanced risk management capabilities that showcase metrics on impact, exploit difficulty, and estimated cost of an attack […] Given the nascency of this capability (April 2024), it is remarkably granular in depth and insight.” (1)

Enabling this is Darktrace’s unique approach to AI extends to risk management capabilities for OT. Darktrace / OT understands customers’ unique risks by building a comprehensive and contextualized picture that goes beyond isolated CVE scoring. It combines attack path modeling with MITRE ATT&CK  techniques to provide hardening recommendations regardless of patching availability and gives you a clearer view of the potential impact of an attack from APT groups.

Modular, scalable security for industrial environments

Organizations need flexibility when it comes to OT security, some want a fully integrated IT-OT security stack, while others prefer a segregated approach due to compliance or operational concerns. The Darktrace ActiveAI Security Platform offers integrated security across multiple domains, allowing flexibility and unification across IT and OT security. The platform combines telemetry from all areas of your digital estate to detect and respond to threats, including OT, network, cloud, email, and user identities.

Omdia recognizes Darktrace’s expansive coverage across multiple domains as a key reason why organizations should consider Darktrace / OT:

“Darktrace’s modular and platform, approach offer’s integrated security across multiple domains. It offers the option of Darktrace / OT as a separate platform product for those that want to segregate IT and OT cybersecurity or are not yet in a position to secure both domains in tandem. The deployment of Darktrace’s platform is flexible—with nine different deployment options, including physical on-premises, virtual, cloud, and hybrid.” (1)

With flexible deployment options, Darktrace offers security teams the ability to choose a model that works best for their organization, ensuring that security doesn’t have to be a “one-size-fits-all” approach.

Conclusion: Why Darktrace / OT stands out in Omdia’s evaluation

Omdia’s 2025 Market Radar for OT Cybersecurity Platforms provides a technical-first, vendor-agnostic evaluation, offering critical insights for organizations looking to strengthen their OT security posture. Darktrace’s recognition as a Market Leader reinforces its unique AI-driven approach, flexible deployment options, and advanced risk management capabilities as key differentiators in an evolving threat landscape.

By leveraging Self-Learning AI, autonomous response, and real-world risk analysis, Darktrace / OT enables organizations to detect, investigate, and mitigate threats before they escalate, without compromising operational uptime.

Read the full report here!

References

  1. www.darktrace.com/resources/darktrace-named-a-market-leader-in-the-2025-omdia-market-radar-for-ot-cybersecurity-platforms
Continue reading
About the author
Pallavi Singh
Product Marketing Manager, OT Security & Compliance

Blog

/

Cloud

/

April 2, 2025

Fusing Vulnerability and Threat Data: Enhancing the Depth of Attack Analysis

Default blog imageDefault blog image

Cado Security, recently acquired by Darktrace, is excited to announce a significant enhancement to its data collection capabilities, with the addition of a vulnerability discovery feature for Linux-based cloud resources. According to Darktrace’s Annual Threat Report 2024, the most significant campaigns observed in 2024 involved the ongoing exploitation of significant vulnerabilities in internet-facing systems. Cado’s new vulnerability discovery capability further deepens its ability to provide extensive context to security teams, enabling them to make informed decisions about threats, faster than ever.

Deep context to accelerate understanding and remediation

Context is critical when understanding the circumstances surrounding a threat. It can also take many forms – alert data, telemetry, file content, business context (for example asset criticality, core function of the resource), and risk context, such as open vulnerabilities.

When performing an investigation, it is common practice to understand the risk profile of the resource impacted, specifically determining open vulnerabilities and how they may relate to the threat. For example, if an analyst is triaging an alert related to an internet-facing Webserver running Apache, it would greatly benefit the analyst to understand open vulnerabilities in the Apache version that is running, if any of them are exploitable, whether a fix is available, etc. This dataset also serves as an invaluable source when developing a remediation plan, identifying specific vulnerabilities to be prioritised for patching.

Data acquisition in Cado

Cado is the only platform with the ability to perform full forensic captures as well as utilize instant triage collection methods, which is why fusing host-based artifact data with vulnerability data is such an exciting and compelling development.

The vulnerability discovery feature can be run as part of an acquisition – full or triage – as well as independently using a fast ‘Scan only’ mode.

Figure 1: A fast vulnerability scan being performed on the acquired evidence

Once the acquisition has completed, the user will have access to a ‘Vulnerabilities’ table within their investigation, where they are able to view and filter open vulnerabilities (by Severity, CVE ID, Resource, and other properties), as well as pivot to the full Event Timeline. In the Event Timeline, the user will be able to identify whether there is any malicious, suspicious or other interesting activity surrounding the vulnerable package, given the unified timeline presents a complete chronological dataset of all evidence and context collected.

Figure 2: Vulnerabilities discovered on the acquired evidence
Figure 3: Pivot from the Vulnerabilities table to the Event Timeline provides an in-depth view of file and process data associated with the vulnerable package selected. In this example, Apache2.

Future work

In the coming months, we’ll be releasing initial versions of highly anticipated integrations between Cado and Darktrace, including the ability to ingest Darktrace / CLOUD alerts which will automatically trigger a forensic capture (as well as a vulnerability discovery) of the impacted assets.

To learn more about how Cado and Darktrace will combine forces, request a demo today.

Continue reading
About the author
Paul Bottomley
Director of Product Management, Cado
Your data. Our AI.
Elevate your network security with Darktrace AI