Skip to content

Outlook Team

Service Name: Microsoft Outlook

Service Description: Microsoft Outlook is a personal information manager software system from Microsoft, available as part of the Microsoft Office suite. It includes email, calendar, contact management, task management, note-taking, journal logging, and web browsing functionalities.

Service Address: https://outlook.office.com/

Validation Type: -

IP Allow list: Does not exist

Secret Access Scope: Grants access to Outlook team webhooks for receiving notifications and alerts.

Secret Revokement URL: Does not exist

Secret Example: https://outlook.office.com/webhook/a1b2c3d4-e5f6-7890-a1b2-c3d4e5f67890@

Suspicious Activity Investigation Instructions:

  • Review webhook activity logs for unauthorized or unusual message patterns.
  • Check Microsoft 365 admin center for suspicious sign-ins or activities.
  • Verify if the webhook is being used by unauthorized applications or services.
  • Monitor for unusual data exfiltration or notification patterns.

Mitigation Instructions:

  • Delete the compromised webhook from Microsoft Teams or Outlook.
  • Create a new webhook with a different endpoint if needed.
  • Review and update access permissions for team members who can create webhooks.
  • Enable audit logging for webhook creation and modification events.
  • Consider implementing IP restrictions for webhook access if possible.