[New RogueApp]: ZoomInfo Communitiez Login

[syne0]

⚠️ Please include as much detail as possible. Please do not submit any private, sensitive, and/or proprietary information.

• Contributor Name: Syne0
• RogueApp Name: ZoomInfo Communitiez Login
• RogueApp ID: 497ac034-5120-4c1a-929a-0351f5c09918
• RogueApp Description: ZoomInfo Communitiez Login is the service principal that is consented to when the "My Connections" feature within ZoomInfo is used. This feature extracts address book and other contact information from the victim account, allowing for ease of target discovery, exfiltration, and targeted phishing attacks.
• App Owner Organization ID: 945a9641-35c7-435c-a5a0-c8753e6dff88
• App Publisher Name:
• App Publisher ID:
• Permissions:
  Microsoft Graph: User.Read (Delegated)
  Microsoft Graph: openid (Delegated)
  Microsoft Graph: Contacts.Read (Delegated)
  Microsoft Graph: Mail.Read (Delegated)
  Microsoft Graph: User.ReadBasic.All (Delegated)
  Microsoft Graph: email (Delegated)
  Microsoft Graph: offline_access (Delegated)
  Microsoft Graph: profile (Delegated)
  Microsoft Graph: MailboxSettings.Read (Delegated)
• Tags: Discovery, Exfiltration, Persistence, Phishing
• MITRE ATT&CK IDs: T1530, T1567, T1087.003
• References: https://cybercorner.tech/common-oauth-apps-used-in-business-email-compromise/#ZoomInfo,
• Date Added: [the date when the RogueApp was added to the repository]

Reference

The RogueApp specification is defined in types.ts. Please submit as much information as you can for each field (it does not have to be 100% complete but please submit everything you can!)

[mattk-huntress]

Hi @syne0! (still Matt/HuskyHacks, just using my company profile now) Thanks for the submission. Will review ASAP.

[syne0]

No problem, and no rush. Sorry to spam you with a bunch of them, but I'm planning on eventually moving my PS module's reference list to this project so wanted to finish getting all the apps ported over.