Skip to content

Commit 2f5c041

Browse files
authored
Add more URLs to whitelist
Zolder made a follow up post where they identified a few extra locations that can trigger branding. https://zolder.io/microsoft-365-aitm-detection-the-lessons-learned/
1 parent 433f702 commit 2f5c041

File tree

1 file changed

+4
-2
lines changed

1 file changed

+4
-2
lines changed

Modules/CIPPCore/Public/Entrypoints/Invoke-PublicPhishingCheck.ps1

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,8 +13,10 @@ Function Invoke-PublicPhishingCheck {
1313
$validList = @(
1414
'https://login.microsoftonline.com',
1515
'https://login.microsoft.net',
16-
'https://login.microsoft.com'
17-
'https://autologon.microsoftazuread-sso.com'
16+
'https://login.microsoft.com',
17+
'https://autologon.microsoftazuread-sso.com',
18+
'https://tasks.office.com',
19+
'https://login.windows.net'
1820
)
1921

2022
$matchedUrls = $validList | Where-Object { ([uri]$_).Host -in ([uri]$($request.headers.Referer)).Host }

0 commit comments

Comments
 (0)