Attackers can use Microsoft Graph to route command-and-control (C2) traffic through legitimate Microsoft services, including Outlook and OneDrive. A compromised device or a malicious OAuth application may use those services to retrieve tasking, exchange messages, or upload and download files. The services are not necessarily vulnerable or compromised; the challenge for defenders is distinguishing abuse from normal cloud activity by correlating endpoint, identity, application, and audit evidence.
What Microsoft Graph has to do with C2
Microsoft Graph is a common interface through which applications access Microsoft services and data, including Outlook and OneDrive. That integration also creates a potential path for abuse: once an attacker has access to a device or cloud identity, malicious activity can use familiar Microsoft infrastructure rather than an obviously suspicious server. The Cyber Security Agency of Singapore describes criminals using Graph to communicate with or host C2 infrastructure on Microsoft cloud services. In one described pattern, malware on an already compromised device uses OneDrive to upload and download malicious files. Singapore Cyber Security Agency, “Defending Against Cyber Threats Leveraging Microsoft Graph API” (2024).
As an Amazon Associate I earn from qualifying purchases.
A Microsoft service hostname by itself is not enough to determine whether a connection is safe. Defenders need context: which process initiated it, what identity and application were involved, what permissions were granted, and whether the resulting cloud activity fits the app’s normal purpose.
How the OneDrive and Outlook cases differ
| Workload | Observed communication pattern | Identity or execution context | What the evidence establishes |
|---|---|---|---|
| OneDrive | Upload or download files; retrieve payloads or tasking | Malware running on a compromised endpoint in the cited examples | The Singapore agency describes OneDrive file exchange as C2; Australia’s 2020 advisory describes LibraryPSE retrieving payloads and tasking. CSA; ACSC |
| Outlook | Use Graph for communications through an Outlook transport; related abuse can also involve mailbox operations | FINALDRAFT sample used an Outlook transport class through Graph | Elastic documents a concrete Outlook-based communication example. Microsoft separately describes suspicious email operations associated with OAuth app abuse; not every mail-abuse example is established as C2. Elastic Security Labs; Microsoft Learn |
| OAuth app and Exchange Online | Control cloud email settings and send spam; OAuth applications are also used more broadly for C2 or backdoors | Malicious application created after attackers gained cloud-tenant access | Microsoft’s 2022 account describes a spam campaign and states that threat actors have also used OAuth apps for C2. The specific spam campaign should not be recast as a demonstrated C2 operation. Microsoft Threat Intelligence (2022) |
OneDrive file-based traffic
OneDrive can serve as a place to exchange files that act as tasking or payloads. The Australian Cyber Security Centre’s 2020 LibraryPSE advisory describes malware embedded in a malicious Word template using OneDrive to obtain additional payloads and tasking. It identifies a URL form under api.onedrive.com and advises examining whether winword.exe initiated the connection. The advisory also gives an associated user-agent as an additional clue. These are incident-specific clues, not universal signatures or a current blocklist. Australian Cyber Security Centre, “Copy-paste compromises” (2020).
#1 Best Overall
The Singapore advisory describes the broader pattern: malware on a device that has already been compromised can use Graph and OneDrive to upload and download malicious files. OneDrive itself is not thereby shown to be compromised or vulnerable. Cyber Security Agency of Singapore (2024).
Outlook and OAuth-based activity
Elastic Security Labs reports that a FINALDRAFT sample used an Outlook transport through Microsoft Graph, and compares the technique with SIESTAGRAPH. This is evidence of a specific Outlook-based communication method, not a measure of how often it is used. Elastic Security Labs, “You’ve Got Malware: FINALDRAFT Hides in Your Drafts”.
OAuth abuse is a related but distinct route. An attacker may create or misuse an application with permissions to access cloud data. Microsoft’s 2022 report describes attackers gaining tenant access, creating malicious OAuth applications, then changing Exchange Online settings and sending spam. Microsoft also notes that threat actors have used OAuth applications for purposes including C2 and backdoors; that broader observation does not mean the described spam incident itself was C2. Microsoft Threat Intelligence, September 22, 2022.
How to investigate suspicious Outlook or OneDrive activity
Build a timeline across endpoint, network, identity, application, and cloud-audit records instead of deciding from a destination hostname or a single alert. Microsoft notes that legitimate applications can produce high-volume activity, so detections need validation against the app’s purpose and expected use.
Rank #3
1. Identify the endpoint process and destination
- Review proxy, DNS, or network telemetry for connections to
api.onedrive.comand identify the process responsible. - For the historical LibraryPSE pattern, a connection initiated by
winword.exeis a useful investigative lead because the malware was loaded in Word. It is not proof of maliciousness by itself. - Correlate process ancestry, file origin, user activity, and endpoint alerts with the connection time. The Australian advisory specifically cautions that further analysis is needed to confirm malicious activity. ACSC advisory.
2. Inspect the OAuth application and grant
- Determine which application performed the activity, who registered it, who consented to it, and when the app or its credentials changed.
- Review the granted scopes and whether they are high privilege or inconsistent with the app’s stated business purpose. Unknown app origin and suspicious permissions are investigation context, not automatic proof of compromise.
- Check whether activity followed a new app registration, consent grant, or credential addition or rotation. Microsoft’s App Governance guidance describes investigating suspicious OAuth application activity and app-related alerts. Microsoft Learn: Investigate OAuth app threat detection alerts with App Governance.
3. Look for workload behavior that fits the suspected channel
- Outlook: Review unusual inbox rule creation, forwarding, replies, message operations, searches, or reads. A new suspicious rule combined with unusual searches is more meaningful than an isolated mail event.
- OneDrive: Investigate unexpectedly numerous searches or edits, unusually high API volume, and activity that begins after an app credential is added or rotated. Compare it with the application’s normal workload and business need.
- Microsoft documents these behaviors as potential indicators for investigating OAuth app threats, while warning that legitimate applications can also generate high volumes. Microsoft Learn; Microsoft Learn: App Governance alerts.
4. Scope activity across users and services
Trace activity associated with the application, its grants and credentials, and affected identities. Establish whether the same app touched other accounts or workloads, and whether activity started before or after a suspicious consent or configuration change. This helps distinguish a single endpoint connection from broader cloud-identity misuse.
Containment and account protection
Response depends on what the investigation confirms. Microsoft’s guidance includes disabling or removing a confirmed malicious application, revoking its consent, reviewing or resetting affected credentials, and removing malicious inbox rules where relevant. Preserve enough audit and endpoint evidence to understand the scope before removing artifacts when incident procedures allow it. Apply containment to the implicated app and identities rather than assuming every use of Microsoft Graph is malicious. Microsoft Learn; Microsoft Learn.
Microsoft’s 2022 account describes initial access involving high-risk administrator accounts without multifactor authentication. Strong administrator sign-in protections, including phishing-resistant options such as FIDO2 security keys, can reduce account-takeover risk; they do not revoke malicious OAuth permissions once those have been granted. Microsoft Threat Intelligence (2022).
Recommended Free Tools
What these examples do—and do not—show
The cited advisories and technical analyses establish that OneDrive file exchange, Outlook transport over Graph, and malicious OAuth applications are real abuse patterns. They do not provide a defensible population-level statistic for how prevalent Outlook- or OneDrive-based C2 is. Historical indicators explain useful detection logic but should not be treated as current infrastructure or a universal signature. Check incident indicators against current threat intelligence, and verify suspicious activity through correlated endpoint and cloud evidence.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
