{"id":14081,"date":"2025-08-06T05:00:37","date_gmt":"2025-08-06T12:00:37","guid":{"rendered":"https:\/\/legacy.gosecure.ai\/?p=14081"},"modified":"2025-08-06T06:51:12","modified_gmt":"2025-08-06T13:51:12","slug":"lutilisation-abusive-de-microsoft-365-direct-send-permet-lusurpation-dadresses-de-courriel-internes","status":"publish","type":"post","link":"https:\/\/legacy.gosecure.ai\/fr\/blog\/2025\/08\/06\/lutilisation-abusive-de-microsoft-365-direct-send-permet-lusurpation-dadresses-de-courriel-internes\/","title":{"rendered":"L&rsquo;utilisation abusive de Microsoft 365 Direct Send permet l&rsquo;usurpation d&rsquo;adresses de courriel internes"},"content":{"rendered":"<p><span data-contrast=\"auto\"> <img class=\"size-medium wp-image-14074 alignright\" src=\"https:\/\/legacy.gosecure.ai\/wp-content\/uploads\/\/Security-Advisory_-Direct-Exploit-Send-FRC-300x157.jpg\" alt=\"\" width=\"300\" height=\"157\" srcset=\"https:\/\/legacy.gosecure.ai\/wp-content\/uploads\/Security-Advisory_-Direct-Exploit-Send-FRC-300x157.jpg 300w, https:\/\/legacy.gosecure.ai\/wp-content\/uploads\/Security-Advisory_-Direct-Exploit-Send-FRC-1024x535.jpg 1024w, https:\/\/legacy.gosecure.ai\/wp-content\/uploads\/Security-Advisory_-Direct-Exploit-Send-FRC-768x401.jpg 768w, https:\/\/legacy.gosecure.ai\/wp-content\/uploads\/Security-Advisory_-Direct-Exploit-Send-FRC-1080x564.jpg 1080w, https:\/\/legacy.gosecure.ai\/wp-content\/uploads\/Security-Advisory_-Direct-Exploit-Send-FRC-980x512.jpg 980w, https:\/\/legacy.gosecure.ai\/wp-content\/uploads\/Security-Advisory_-Direct-Exploit-Send-FRC-480x251.jpg 480w, https:\/\/legacy.gosecure.ai\/wp-content\/uploads\/Security-Advisory_-Direct-Exploit-Send-FRC.jpg 1200w\" sizes=\"(max-width: 300px) 100vw, 300px\" \/><span data-contrast=\"auto\">Les cybercriminels exploitent une fonctionnalit\u00e9 peu connue de Microsoft 365, l\u2019envoi direct, initialement con\u00e7ue pour les p\u00e9riph\u00e9riques internes comme les imprimantes, pour envoyer des courriels semblant provenir de coll\u00e8gues de confiance. Ces courriels usurp\u00e9s contournent souvent les contr\u00f4les de s\u00e9curit\u00e9 standards, ce qui les rend particuli\u00e8rement dangereux. <\/span> <\/span><\/p>\n<h4 aria-level=\"3\"><b><span data-contrast=\"auto\">Pourquoi c&rsquo;est important ?<\/span><\/b><\/h4>\n<p><b><span data-contrast=\"auto\">Usurpation d&rsquo;adresse courriel interne sans identifiants de connexion<\/span><\/b><\/p>\n<p><span data-contrast=\"auto\">Les pirates utilisent l&rsquo;envoi direct pour envoyer de faux courriels \u00e0 partir de votre propre domaine. Dans certains cas, le message peut m\u00eame sembler vous \u00eatre adress\u00e9. Cette technique ne n\u00e9cessite ni identifiants, ni acc\u00e8s \u00e0 la passerelle, ni connexion. <\/span><\/p>\n<p aria-level=\"3\"><b><span data-contrast=\"auto\">Qu&rsquo;est-ce qui se passe ?<\/span><\/b><\/p>\n<p><span data-contrast=\"auto\">Notre \u00e9quipe GoSecure TitanMC IDR a observ\u00e9 des campagnes utilisant l\u2019envoi direct en envoyant des messages usurp\u00e9s directement \u00e0 l\u2019h\u00f4te intelligent de Microsoft (par exemple, mail.protection.outlook.com). L&rsquo;attaquant manipule les en-t\u00eates des courriels pour faire appara\u00eetre le message comme interne, alors qu&rsquo;il provient d&rsquo;une adresse IP externe non autoris\u00e9e. <\/span><\/p>\n<p><span data-contrast=\"auto\">Voici un exemple d&rsquo;en-t\u00eate signal\u00e9 :<\/span><\/p>\n<p><span data-contrast=\"auto\">Re\u00e7u : de [141.95.71.213] (141.95.71.213) par<\/span><br \/>\n<span data-contrast=\"auto\">SA2PEPF00003AEA.mail.protection.outlook.com avec le serveur SMTP Microsoft<\/span><\/p>\n<h4 aria-level=\"3\"><b><span data-contrast=\"auto\">Pourquoi \u00e7a marche ?<\/span><\/b><\/h4>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"1\" data-list-defn-props=\"{\" data-aria-posinset=\"1\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Aucune connexion requise :<\/span><\/b><span data-contrast=\"auto\"> l&rsquo;infrastructure Microsoft accepte les courriels achemin\u00e9s par Direct Send vers des destinataires internes. <\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"1\" data-list-defn-props=\"{\" data-aria-posinset=\"2\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Usurpation de l&rsquo;exp\u00e9diteur :<\/span><\/b><span data-contrast=\"auto\"> l&rsquo;attaquant d\u00e9finit l&rsquo;adresse d&rsquo;exp\u00e9diteur comme n&rsquo;importe quel utilisateur interne. <\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"1\" data-list-defn-props=\"{\" data-aria-posinset=\"3\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Contournement des filtres :<\/span><\/b><span data-contrast=\"auto\"> les filtres Microsoft traitent le message comme interne, ce qui le rend plus difficile \u00e0 intercepter. <\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"1\" data-list-defn-props=\"{\" data-aria-posinset=\"4\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">\u00c9vasion des outils de d\u00e9tection : <\/span><\/b><span data-contrast=\"auto\">ces courriels peuvent \u00e9chapper aux outils tiers qui recherchent des signes externes de compromission. <\/span><\/li>\n<\/ul>\n<h4 aria-level=\"3\"><b><span data-contrast=\"auto\">Comment d\u00e9tecter les failles d&rsquo;envoi direct<\/span><\/b><\/h4>\n<p><b><span data-contrast=\"auto\">Signaux d&rsquo;alerte d&rsquo;en-t\u00eate<\/span><\/b><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"2\" data-list-defn-props=\"{\" data-aria-posinset=\"1\" data-aria-level=\"1\"><span data-contrast=\"auto\">Courriels re\u00e7us par des h\u00f4tes intelligents Microsoft provenant d&rsquo;adresses IP externes non autoris\u00e9es<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"2\" data-list-defn-props=\"{\" data-aria-posinset=\"2\" data-aria-level=\"1\"><span data-contrast=\"auto\">\u00c9checs d&rsquo;authentification (SPF, DKIM, DMARC) sur votre propre domaine<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"2\" data-list-defn-props=\"{\" data-aria-posinset=\"3\" data-aria-level=\"1\"><span data-contrast=\"auto\">Valeurs non concordantes X-MS-Exchange-CrossTenant-Id<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"2\" data-list-defn-props=\"{\" data-aria-posinset=\"4\" data-aria-level=\"1\"><span data-contrast=\"auto\">Entr\u00e9es \u00e9tranges dans les enregistrements SPF<\/span><\/li>\n<\/ul>\n<p><b><span data-contrast=\"auto\">Signes de Compromission<\/span><\/b><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"3\" data-list-defn-props=\"{\" data-aria-posinset=\"1\" data-aria-level=\"1\"><span data-contrast=\"auto\">Courriels envoy\u00e9s par les utilisateurs \u00e0 eux-m\u00eames<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"3\" data-list-defn-props=\"{\" data-aria-posinset=\"2\" data-aria-level=\"1\"><span data-contrast=\"auto\">IP \u00e9trang\u00e8res ou suspectes<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"3\" data-list-defn-props=\"{\" data-aria-posinset=\"3\" data-aria-level=\"1\"><span data-contrast=\"auto\">Pi\u00e8ces jointes inattendues ou noms de fichiers \u00e9tranges<\/span><\/li>\n<\/ul>\n<h4 aria-level=\"3\"><b><span data-contrast=\"auto\">Ce que vous pouvez faire<\/span><\/b><\/h4>\n<p aria-level=\"4\"><b><span data-contrast=\"auto\">Activer RejectDirectSend dans Office 365 <\/span><\/b><\/p>\n<p><b><span data-contrast=\"auto\">Rejeter l&rsquo;envoi direct<\/span><\/b><br \/>\n<span data-contrast=\"auto\">Microsoft a introduit une fonctionnalit\u00e9 d&rsquo;activation permettant de bloquer les messages d&rsquo;envoi direct non authentifi\u00e9s. Activez-le via PowerShell : <\/span><\/p>\n<p><span data-ccp-props=\"{\"> <img class=\"alignnone wp-image-14071 size-large\" src=\"https:\/\/legacy.gosecure.ai\/wp-content\/uploads\/\/powershell-1024x396.png\" alt=\"\" width=\"1024\" height=\"396\" srcset=\"https:\/\/legacy.gosecure.ai\/wp-content\/uploads\/powershell-1024x396.png 1024w, https:\/\/legacy.gosecure.ai\/wp-content\/uploads\/powershell-300x116.png 300w, https:\/\/legacy.gosecure.ai\/wp-content\/uploads\/powershell-768x297.png 768w, https:\/\/legacy.gosecure.ai\/wp-content\/uploads\/powershell-1536x594.png 1536w, https:\/\/legacy.gosecure.ai\/wp-content\/uploads\/powershell-1080x417.png 1080w, https:\/\/legacy.gosecure.ai\/wp-content\/uploads\/powershell-1280x495.png 1280w, https:\/\/legacy.gosecure.ai\/wp-content\/uploads\/powershell-980x379.png 980w, https:\/\/legacy.gosecure.ai\/wp-content\/uploads\/powershell-480x185.png 480w, https:\/\/legacy.gosecure.ai\/wp-content\/uploads\/powershell.png 1897w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/span><\/p>\n<p><span data-contrast=\"auto\">Une fois activ\u00e9, les messages non autoris\u00e9s seront bloqu\u00e9s avec :<\/span><\/p>\n<p><span data-contrast=\"auto\">550 5.7.68 TenantInboundAttribution ; Envoi direct non autoris\u00e9 pour cette organisation provenant de sources non autoris\u00e9es<\/span><\/p>\n<p aria-level=\"4\"><b><span data-contrast=\"auto\">Mesures d&rsquo;att\u00e9nuation suppl\u00e9mentaires :<\/span><\/b><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"4\" data-list-defn-props=\"{\" data-aria-posinset=\"1\" data-aria-level=\"1\"><span data-contrast=\"auto\">Mettre en \u0153uvre une politique <\/span><span data-contrast=\"auto\">DMARC stricte <\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"4\" data-list-defn-props=\"{\" data-aria-posinset=\"2\" data-aria-level=\"1\"><span data-contrast=\"auto\">Marquer les messages internes non authentifi\u00e9s pour examen ou mise en quarantaine<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"4\" data-list-defn-props=\"{\" data-aria-posinset=\"3\" data-aria-level=\"1\"><span data-contrast=\"auto\">Imposer l&rsquo;\u00e9chec SPF dans Exchange Online Protection (EOP) Enforce <\/span><span data-contrast=\"auto\">SPF <\/span><span data-contrast=\"auto\">hardfail in Exchange Online Protection (EOP)<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"4\" data-list-defn-props=\"{\" data-aria-posinset=\"4\" data-aria-level=\"1\"><span data-contrast=\"auto\">D\u00e9finir des r\u00e8gles anti-usurpation d&rsquo;identit\u00e9 dans Microsoft Defender<\/span><\/li>\n<\/ul>\n<h4 aria-level=\"3\"><b><span data-contrast=\"auto\">Consid\u00e9rations<\/span><\/b><\/h4>\n<p><span data-contrast=\"auto\">Veuillez noter que tous les courriels d&rsquo;envoi direct ne sont pas malveillants. En activant RejectDirectSend, vous pouvez bloquer certains courriels l\u00e9gitimes. Exemples d&rsquo;utilisation l\u00e9gitime de l&rsquo;envoi direct : <\/span><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"5\" data-list-defn-props=\"{\" data-aria-posinset=\"1\" data-aria-level=\"1\"><span data-contrast=\"auto\">Rapports automatis\u00e9s d&rsquo;outils internes<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"5\" data-list-defn-props=\"{\" data-aria-posinset=\"2\" data-aria-level=\"1\"><span data-contrast=\"auto\">Alertes ou sauvegardes sc\u00e9naris\u00e9es<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"5\" data-list-defn-props=\"{\" data-aria-posinset=\"3\" data-aria-level=\"1\"><span data-contrast=\"auto\">Plateformes de tierces parties autoris\u00e9es (RH, CRM, marketing)<\/span><\/li>\n<\/ul>\n<p><span data-contrast=\"auto\">En cas de doute, ne cliquez pas. Signalez-le \u00e0 votre \u00e9quipe de s\u00e9curit\u00e9. <\/span><\/p>\n<h4 aria-level=\"3\"><b><span data-contrast=\"auto\">Comment GoSecure vous aide<\/span><\/b><\/h4>\n<p><span data-contrast=\"auto\">Notre \u00e9quipe GoSecure TitanMC IDR surveille activement cet exploit et met \u00e0 jour le contenu de d\u00e9tection. Nous renfor\u00e7ons \u00e9galement les r\u00e8gles dorsales de notre infrastructure afin de r\u00e9duire le risque de fausse confiance interne. <\/span><\/p>\n<p><span data-contrast=\"auto\">Si vous avez besoin d&rsquo;aide pour revoir votre configuration ou activer des mesures de protection, notre \u00e9quipe est l\u00e0 pour vous.<\/span><\/p>\n<p><b><span data-contrast=\"auto\">Agissez aujourd&rsquo;hui<\/span><\/b><br \/>\n<span data-contrast=\"auto\">Les menaces d&rsquo;hame\u00e7onnage sophistiqu\u00e9es peuvent sembler tout \u00e0 fait l\u00e9gitimes. Pour \u00e9valuer votre exposition ou configurer des param\u00e8tres par d\u00e9faut plus s\u00e9curitaires, contactez GoSecure d\u00e8s aujourd&rsquo;hui. <\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p><span data-contrast=\"auto\"> <img class=\"alignright wp-image-14075 size-medium\" src=\"https:\/\/legacy.gosecure.ai\/wp-content\/uploads\/Security-Advisory_-Direct-Exploit-Send-ENG-300x157.jpg\" alt=\"\" width=\"300\" height=\"157\">Les cybercriminels exploitent une fonctionnalit\u00e9 peu connue de Microsoft 365, l\u2019envoi direct, initialement con\u00e7ue pour les p\u00e9riph\u00e9riques internes comme les imprimantes, pour envoyer des courriels semblant provenir de coll\u00e8gues de confiance. Ces courriels usurp\u00e9s contournent souvent les contr\u00f4les de s\u00e9curit\u00e9 standards, ce qui les rend particuli\u00e8rement dangereux. <\/span><span data-ccp-props=\"{\"134233117\":false,\"134233118\":false,\"335559738\":240,\"335559739\":240}\"> <\/span><\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","footnotes":""},"categories":[437,446,448,632],"tags":[831,826,833,832,822,830,828,452,823,827,834,829,825,824],"class_list":["post-14081","post","type-post","status-publish","format-standard","hentry","category-avis-de-securite","category-email-security-fr","category-phishing-fr","category-threat-intelligence-fr","tag-anti-usurpation-didentite","tag-campagne-dhameconnage","tag-cyberattaque","tag-detection-des-menaces-par-courriel","tag-direct-send-fr","tag-dkim-fr","tag-dmarc-fr","tag-email-security-fr","tag-microsoft-365-fr","tag-microsoft-exchange-fr","tag-protection-des-courriels","tag-spf-fr","tag-usurpation-dadresse-courriel","tag-usurpation-didentite-interne"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v23.0 (Yoast SEO v23.0) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>L&#039;utilisation abusive de Microsoft 365 Direct Send permet l&#039;usurpation d&#039;adresses de courriel internes - GoSecure<\/title>\n<meta name=\"description\" content=\"Les cybercriminels exploitent une fonctionnalit\u00e9 peu connue de Microsoft 365, l\u2019envoi direct, initialement con\u00e7ue pour les p\u00e9riph\u00e9riques internes comme les imprimantes, pour envoyer des courriels semblant provenir de coll\u00e8gues de confiance. Ces courriels usurp\u00e9s contournent souvent les contr\u00f4les de s\u00e9curit\u00e9 standards, ce qui les rend particuli\u00e8rement dangereux.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/legacy.gosecure.ai\/fr\/blog\/2025\/08\/06\/lutilisation-abusive-de-microsoft-365-direct-send-permet-lusurpation-dadresses-de-courriel-internes\/\" \/>\n<meta property=\"og:locale\" content=\"fr_FR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"L&#039;utilisation abusive de Microsoft 365 Direct Send permet l&#039;usurpation d&#039;adresses de courriel internes\" \/>\n<meta property=\"og:description\" content=\"Les cybercriminels exploitent une fonctionnalit\u00e9 peu connue de Microsoft 365, l\u2019envoi direct, initialement con\u00e7ue pour les p\u00e9riph\u00e9riques internes comme les imprimantes, pour envoyer des courriels semblant provenir de coll\u00e8gues de confiance. Ces courriels usurp\u00e9s contournent souvent les contr\u00f4les de s\u00e9curit\u00e9 standards, ce qui les rend particuli\u00e8rement dangereux.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/legacy.gosecure.ai\/fr\/blog\/2025\/08\/06\/lutilisation-abusive-de-microsoft-365-direct-send-permet-lusurpation-dadresses-de-courriel-internes\/\" \/>\n<meta property=\"og:site_name\" content=\"GoSecure\" \/>\n<meta property=\"article:published_time\" content=\"2025-08-06T12:00:37+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-08-06T13:51:12+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/legacy.gosecure.ai\/wp-content\/uploads\/\/Security-Advisory_-Direct-Exploit-Send-FRC-300x157.jpg\" \/>\n<meta name=\"author\" content=\"GoSecure\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@GoSecure_Inc\" \/>\n<meta name=\"twitter:site\" content=\"@GoSecure_Inc\" \/>\n<meta name=\"twitter:label1\" content=\"\u00c9crit par\" \/>\n\t<meta name=\"twitter:data1\" content=\"GoSecure\" \/>\n\t<meta name=\"twitter:label2\" content=\"Dur\u00e9e de lecture estim\u00e9e\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/legacy.gosecure.ai\/fr\/blog\/2025\/08\/06\/lutilisation-abusive-de-microsoft-365-direct-send-permet-lusurpation-dadresses-de-courriel-internes\/\",\"url\":\"https:\/\/legacy.gosecure.ai\/fr\/blog\/2025\/08\/06\/lutilisation-abusive-de-microsoft-365-direct-send-permet-lusurpation-dadresses-de-courriel-internes\/\",\"name\":\"L'utilisation abusive de Microsoft 365 Direct Send permet l'usurpation d'adresses de courriel internes - GoSecure\",\"isPartOf\":{\"@id\":\"https:\/\/legacy.gosecure.ai\/fr\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/legacy.gosecure.ai\/fr\/blog\/2025\/08\/06\/lutilisation-abusive-de-microsoft-365-direct-send-permet-lusurpation-dadresses-de-courriel-internes\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/legacy.gosecure.ai\/fr\/blog\/2025\/08\/06\/lutilisation-abusive-de-microsoft-365-direct-send-permet-lusurpation-dadresses-de-courriel-internes\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/legacy.gosecure.ai\/wp-content\/uploads\/\/Security-Advisory_-Direct-Exploit-Send-FRC-300x157.jpg\",\"datePublished\":\"2025-08-06T12:00:37+00:00\",\"dateModified\":\"2025-08-06T13:51:12+00:00\",\"author\":{\"@id\":\"https:\/\/legacy.gosecure.ai\/fr\/#\/schema\/person\/11f4bfed2ab7b748dfc255aa91baedca\"},\"description\":\"Les cybercriminels exploitent une fonctionnalit\u00e9 peu connue de Microsoft 365, l\u2019envoi direct, initialement con\u00e7ue pour les p\u00e9riph\u00e9riques internes comme les imprimantes, pour envoyer des courriels semblant provenir de coll\u00e8gues de confiance. Ces courriels usurp\u00e9s contournent souvent les contr\u00f4les de s\u00e9curit\u00e9 standards, ce qui les rend particuli\u00e8rement dangereux.\",\"breadcrumb\":{\"@id\":\"https:\/\/legacy.gosecure.ai\/fr\/blog\/2025\/08\/06\/lutilisation-abusive-de-microsoft-365-direct-send-permet-lusurpation-dadresses-de-courriel-internes\/#breadcrumb\"},\"inLanguage\":\"fr-FR\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/legacy.gosecure.ai\/fr\/blog\/2025\/08\/06\/lutilisation-abusive-de-microsoft-365-direct-send-permet-lusurpation-dadresses-de-courriel-internes\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"fr-FR\",\"@id\":\"https:\/\/legacy.gosecure.ai\/fr\/blog\/2025\/08\/06\/lutilisation-abusive-de-microsoft-365-direct-send-permet-lusurpation-dadresses-de-courriel-internes\/#primaryimage\",\"url\":\"https:\/\/legacy.gosecure.ai\/wp-content\/uploads\/\/Security-Advisory_-Direct-Exploit-Send-FRC-300x157.jpg\",\"contentUrl\":\"https:\/\/legacy.gosecure.ai\/wp-content\/uploads\/\/Security-Advisory_-Direct-Exploit-Send-FRC-300x157.jpg\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/legacy.gosecure.ai\/fr\/blog\/2025\/08\/06\/lutilisation-abusive-de-microsoft-365-direct-send-permet-lusurpation-dadresses-de-courriel-internes\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/legacy.gosecure.ai\/fr\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"L&#8217;utilisation abusive de Microsoft 365 Direct Send permet l&#8217;usurpation d&#8217;adresses de courriel internes\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/legacy.gosecure.ai\/fr\/#website\",\"url\":\"https:\/\/legacy.gosecure.ai\/fr\/\",\"name\":\"GoSecure\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/legacy.gosecure.ai\/fr\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"fr-FR\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/legacy.gosecure.ai\/fr\/#\/schema\/person\/11f4bfed2ab7b748dfc255aa91baedca\",\"name\":\"GoSecure\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"L'utilisation abusive de Microsoft 365 Direct Send permet l'usurpation d'adresses de courriel internes - GoSecure","description":"Les cybercriminels exploitent une fonctionnalit\u00e9 peu connue de Microsoft 365, l\u2019envoi direct, initialement con\u00e7ue pour les p\u00e9riph\u00e9riques internes comme les imprimantes, pour envoyer des courriels semblant provenir de coll\u00e8gues de confiance. Ces courriels usurp\u00e9s contournent souvent les contr\u00f4les de s\u00e9curit\u00e9 standards, ce qui les rend particuli\u00e8rement dangereux.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/legacy.gosecure.ai\/fr\/blog\/2025\/08\/06\/lutilisation-abusive-de-microsoft-365-direct-send-permet-lusurpation-dadresses-de-courriel-internes\/","og_locale":"fr_FR","og_type":"article","og_title":"L'utilisation abusive de Microsoft 365 Direct Send permet l'usurpation d'adresses de courriel internes","og_description":"Les cybercriminels exploitent une fonctionnalit\u00e9 peu connue de Microsoft 365, l\u2019envoi direct, initialement con\u00e7ue pour les p\u00e9riph\u00e9riques internes comme les imprimantes, pour envoyer des courriels semblant provenir de coll\u00e8gues de confiance. Ces courriels usurp\u00e9s contournent souvent les contr\u00f4les de s\u00e9curit\u00e9 standards, ce qui les rend particuli\u00e8rement dangereux.","og_url":"https:\/\/legacy.gosecure.ai\/fr\/blog\/2025\/08\/06\/lutilisation-abusive-de-microsoft-365-direct-send-permet-lusurpation-dadresses-de-courriel-internes\/","og_site_name":"GoSecure","article_published_time":"2025-08-06T12:00:37+00:00","article_modified_time":"2025-08-06T13:51:12+00:00","og_image":[{"url":"https:\/\/legacy.gosecure.ai\/wp-content\/uploads\/\/Security-Advisory_-Direct-Exploit-Send-FRC-300x157.jpg"}],"author":"GoSecure","twitter_card":"summary_large_image","twitter_creator":"@GoSecure_Inc","twitter_site":"@GoSecure_Inc","twitter_misc":{"\u00c9crit par":"GoSecure","Dur\u00e9e de lecture estim\u00e9e":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/legacy.gosecure.ai\/fr\/blog\/2025\/08\/06\/lutilisation-abusive-de-microsoft-365-direct-send-permet-lusurpation-dadresses-de-courriel-internes\/","url":"https:\/\/legacy.gosecure.ai\/fr\/blog\/2025\/08\/06\/lutilisation-abusive-de-microsoft-365-direct-send-permet-lusurpation-dadresses-de-courriel-internes\/","name":"L'utilisation abusive de Microsoft 365 Direct Send permet l'usurpation d'adresses de courriel internes - GoSecure","isPartOf":{"@id":"https:\/\/legacy.gosecure.ai\/fr\/#website"},"primaryImageOfPage":{"@id":"https:\/\/legacy.gosecure.ai\/fr\/blog\/2025\/08\/06\/lutilisation-abusive-de-microsoft-365-direct-send-permet-lusurpation-dadresses-de-courriel-internes\/#primaryimage"},"image":{"@id":"https:\/\/legacy.gosecure.ai\/fr\/blog\/2025\/08\/06\/lutilisation-abusive-de-microsoft-365-direct-send-permet-lusurpation-dadresses-de-courriel-internes\/#primaryimage"},"thumbnailUrl":"https:\/\/legacy.gosecure.ai\/wp-content\/uploads\/\/Security-Advisory_-Direct-Exploit-Send-FRC-300x157.jpg","datePublished":"2025-08-06T12:00:37+00:00","dateModified":"2025-08-06T13:51:12+00:00","author":{"@id":"https:\/\/legacy.gosecure.ai\/fr\/#\/schema\/person\/11f4bfed2ab7b748dfc255aa91baedca"},"description":"Les cybercriminels exploitent une fonctionnalit\u00e9 peu connue de Microsoft 365, l\u2019envoi direct, initialement con\u00e7ue pour les p\u00e9riph\u00e9riques internes comme les imprimantes, pour envoyer des courriels semblant provenir de coll\u00e8gues de confiance. Ces courriels usurp\u00e9s contournent souvent les contr\u00f4les de s\u00e9curit\u00e9 standards, ce qui les rend particuli\u00e8rement dangereux.","breadcrumb":{"@id":"https:\/\/legacy.gosecure.ai\/fr\/blog\/2025\/08\/06\/lutilisation-abusive-de-microsoft-365-direct-send-permet-lusurpation-dadresses-de-courriel-internes\/#breadcrumb"},"inLanguage":"fr-FR","potentialAction":[{"@type":"ReadAction","target":["https:\/\/legacy.gosecure.ai\/fr\/blog\/2025\/08\/06\/lutilisation-abusive-de-microsoft-365-direct-send-permet-lusurpation-dadresses-de-courriel-internes\/"]}]},{"@type":"ImageObject","inLanguage":"fr-FR","@id":"https:\/\/legacy.gosecure.ai\/fr\/blog\/2025\/08\/06\/lutilisation-abusive-de-microsoft-365-direct-send-permet-lusurpation-dadresses-de-courriel-internes\/#primaryimage","url":"https:\/\/legacy.gosecure.ai\/wp-content\/uploads\/\/Security-Advisory_-Direct-Exploit-Send-FRC-300x157.jpg","contentUrl":"https:\/\/legacy.gosecure.ai\/wp-content\/uploads\/\/Security-Advisory_-Direct-Exploit-Send-FRC-300x157.jpg"},{"@type":"BreadcrumbList","@id":"https:\/\/legacy.gosecure.ai\/fr\/blog\/2025\/08\/06\/lutilisation-abusive-de-microsoft-365-direct-send-permet-lusurpation-dadresses-de-courriel-internes\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/legacy.gosecure.ai\/fr\/"},{"@type":"ListItem","position":2,"name":"L&#8217;utilisation abusive de Microsoft 365 Direct Send permet l&#8217;usurpation d&#8217;adresses de courriel internes"}]},{"@type":"WebSite","@id":"https:\/\/legacy.gosecure.ai\/fr\/#website","url":"https:\/\/legacy.gosecure.ai\/fr\/","name":"GoSecure","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/legacy.gosecure.ai\/fr\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"fr-FR"},{"@type":"Person","@id":"https:\/\/legacy.gosecure.ai\/fr\/#\/schema\/person\/11f4bfed2ab7b748dfc255aa91baedca","name":"GoSecure"}]}},"_links":{"self":[{"href":"https:\/\/legacy.gosecure.ai\/fr\/wp-json\/wp\/v2\/posts\/14081","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/legacy.gosecure.ai\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/legacy.gosecure.ai\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/legacy.gosecure.ai\/fr\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/legacy.gosecure.ai\/fr\/wp-json\/wp\/v2\/comments?post=14081"}],"version-history":[{"count":0,"href":"https:\/\/legacy.gosecure.ai\/fr\/wp-json\/wp\/v2\/posts\/14081\/revisions"}],"wp:attachment":[{"href":"https:\/\/legacy.gosecure.ai\/fr\/wp-json\/wp\/v2\/media?parent=14081"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/legacy.gosecure.ai\/fr\/wp-json\/wp\/v2\/categories?post=14081"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/legacy.gosecure.ai\/fr\/wp-json\/wp\/v2\/tags?post=14081"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}