← Back to Pulse Feed
PULSE DETAIL
PULSE NAME
Hidden in UAlberta system Files
WHITE Disable_Duck 2024-06-05 Modified: 2024-09-03
192
IOCs
HIGH VOLUME
Azure/Entra things hidden in System Files of UAlberta Sample Device. Found this too: Clarification: My account, but U of A owned Tenant, but not actually my account? Either way I avoid signing into Google or Microsoft UAlberta emails. Bad things happen. Found this though on the Microsoft Side: License Azure AD for Office 365 (Check out Strings in referenced files - no idea). Anyone? Tenant ID 718b8a9b-44d8-441a-a344-4294ea842172 Primary domain ualbertaca.onmicrosoft.com Custom Domain Names ualberta.ca Verified ualbertaca.onmicrosoft.com
falsetruevisibleapplicationmicrosoft teamsmicrosoft azureofficeservicedynamicshiddenandroidexplorerwriteconnectortestsharepointlivemeistertoolsdesktopsparkfrontenterprisedesigneratlaspremiumassistantallowazureadmyorggameverifymicrosoft powerchannelsurfclimtd1file transfermagnusmicrosoft crmyouth
Indicators of Compromise (1 / 192 total)
All FileHash-MD5 FileHash-SHA256 domain hostname FileHash-SHA1 URL
TYPEINDICATORDESCRIPTIONCREATED
FileHash-MD5 94d3210d19a24e11b4b13a1571b990a0 — 2024-06-05
References (8)
↗ 08.31.23 - WTH UA - azure settings.json ↗ All - EnterpriseAppsList.csv ↗ EnterpriseAppsList.csv ↗ Hidden Apps - EnterpriseAppsList.csv ↗ AppRegistrationList.csv ↗ 3be7e5720ce46f22221140a2c4b4de3a65c622465f3eef471d6927b0572a2fcc ↗ c9903e19d8d66274027d7ae6fee7ff9647cf5c8af2f2e74e896def4093b03f66 ↗ 0590d2c4fd59ffcb0b431748d38b199bbde2841e03f775b30a1d55cce41269d1