• United States



Contributing Writer

How to defend Office 365 from spear-phishing attacks

Jan 30, 20192 mins
PhishingSecuritySmall and Medium Business

A recent successful zero-day Flash attack began with a spear-phishing email. These Windows 10 and Office 365 settings could have prevented it.

A recent Windows Defender Advanced Threat Protection (ATP) alert described an Adobe Flash zero-day vulnerability (CVE-2018-15982) that was used in a spear-phishing attack against a medical institution in Russia. Adobe released a patch on December 5, 2018. This vulnerability and attack sequence highlighted a number of mitigations that you can use to block such attacks.

The attack started with a spear-phishing campaign. In this instance, the spear-phishing email consisted of a RAR archive file containing two files. The first was a lure document. The second was a another RAR archive file disguised as a .jpg file.

When the user opened the document, an embedded Active X Flash control was activated. The control then ran a command script that unzipped the archive file and ran the payload. A scheduled task was created to start a backdoor whenever the user logged in. It collected system information and then uploaded it to a hard-coded command-and-control IP address every five minutes. The backdoor was set to be able to receive instructions that could be loaded into memory.

You can mitigate this threat in several ways, and you can detect if your email account has been compromised. Enable Windows Defender System Guard to turn on hardware-based isolation. Enable cloud-delivered protection and automatic sample submission in Windows Defender Antivirus. This allows machine learning to detect new variants.

bradley spear Microsoft

Enable cloud-delivered protection

Check the settings in Office 365 to ensure that you can block targeted spear phishing attempts. Ensure that you have enabled or purchased Office 365 ATP. Make sure that Office 365 checks on links (ATP Safe links) and deletes sent email based on threats.

Turn on attack surface reduction rules on Windows 10 to limit executable activity initiated by Office macros. Review what actions on internet connections you can take on your firewall to limit browsing or arbitrarily downloading files. Also review if you have the ability to limit connections by geographic connections, IP or any other options.

Bottom line, before you are attacked, look for ways that you can protect yourself now. Don’t think in terms of “if” you will be attacked, think in terms of “when”.

Contributing Writer

Susan Bradley has been patching since before the Code Red/Nimda days and remembers exactly where she was when SQL slammer hit (trying to buy something on eBay and wondering why the Internet was so slow). She writes the Patch Watch column for, is a moderator on the listserve, and writes a column of Windows security tips for In real life, she’s the IT wrangler at her firm, Tamiyasu, Smith, Horn and Braun, where she manages a fleet of Windows servers, Microsoft 365 deployments, Azure instances, desktops, a few Macs, several iPads, a few Surface devices, several iPhones and tries to keep patches up to date on all of them. In addition, she provides forensic computer investigations for the litigation consulting arm of the firm. She blogs at and is on twitter at @sbsdiva. She lurks on Twitter and Facebook, so if you are on Facebook with her, she really did read what you posted. She has a SANS/GSEC certification in security and prefers Heavy Duty Reynolds wrap for her tinfoil hat.

More from this author