Key points for analyzing andresponding to email intrusions
ITOCHU Cyber & Intelligence Inc.

Cybersecurity Analyst
Yumi Iida

Background• From 2019 to 2022, the number of reported phishing attacks increased by about 4 times.*1• Microsoft 365 is the 2nd most popular email server provider in the world, with a market
share of 13.5%. It is used by many organizations.*2• In 2021, a new attack called AiTM (Adversary in the Middle) emerged that can bypass
MFA, which had been effective in defending against BEC attacks. *3• AiTM (aka Token Replay attacks) doubled from 30,000 to 70,000 per month between 2022
and 2023. Reports suggests it will remain effective in the future. *4

Reference:*1 AWPG Report (https://docs.apwg.org/reports/apwg_trends_report_q3_2022.pdf )*2 Web Technology Surveys – Usage statistics of email server providers (https://w3techs.com/technologies/overview/email_server )*3 Blog - From cookie theft to BEC: Attackers use AiTM phishing sites as entry point to further financial fraud (https://www.microsoft.com/en-us/security/blog/2022/07/12/from-cookie-theft-to-bec-attackers-use-aitm-phishing-sites-asentry-point-to-further-financial-fraud/ )*4 Microsoft Digital Defense Report 2023 (https://www.microsoft.com/en-us/security/security-insider/microsoft-digital-defense-report-2023 )ITOCHU Cyber & Intelligence Inc.

2

What is AiTM?
Previous Attack

Attacker

User

Phishing site

Attack by AiTM

Target website

Attacker

User

**

**

Enter ID/Pass

Send a mailPhishing site

Send a mail**Get ID/PassEnter ID/Pass+MFA

Target website**
Enter ID/Pass+MFA

Get Session Cookie**

Blocked by MFA

Sign in as User

Sign in as User

MFA bypassed

ITOCHU Cyber & Intelligence Inc.

3

Challenges in Incident Response• Unclear initial response• Time-consuming to select and collect appropriate logs
• Unclear what logs suggest attack traces• Lack of systematic response in case attack traces are foundInappropriate response can lead to the expansion of damage

ITOCHU Cyber & Intelligence Inc.

4

Purpose of this presentation
It will cover the following topics based on a real-world M365 account intrusion incident:• Initial response to an incident

The goal:• Key points of incident investigation• Details of attacker traces and associated logs

✓ Understand the key points ofincident response for quickly andeffectively✓ Understand effective defense
measures• Incident prevention

ITOCHU Cyber & Intelligence Inc.

5

Let's practice incident response!
Created a demo incident based on a real-world Microsoft 365 incident.

You are a CSIRT member of a certain trading company.
The company's IT environment is as follows.
Employees:
Licenses:
Mail service:
Multi-factor authentication:

300
Microsoft 365 Enterprise E3
Exchange Online only
Microsoft Authenticator (OTP app)

ITOCHU Cyber & Intelligence Inc.

6

Incident Occurred!

* Johanna is the default user.
ITOCHU Cyber & Intelligence Inc.

7

Incident Occurred!

* Johanna is the default user.

What are the steps for the incident response?
Incident
Occurred

InitialResponse

Log
Log
ReportingCollection Investigation
ITOCHU Cyber & Intelligence Inc.

Defensive
Measures8

Initial Response

ITOCHU Cyber & Intelligence Inc.

9

Initial Response

InitialResponse

Which do you do?

Disconnect the company network
Collect and clean up Johnna’s computer
Delete Johanna’s accountDisable Johanna’s account session and reset his password

ITOCHU Cyber & Intelligence Inc.

10

DEMO

Initial Response

InitialResponse

ITOCHU Cyber & Intelligence Inc.

11

DEMO

Initial Response

InitialResponse✓ Contain the intrusion• Disconnect the session• Remove the registered suspicious security info

✓ Do not erase the traces• Do not generally “delete”• Explore the “disable” option✓ Identify the scope of the intrusion• Check for similar intrusion
within the organization

ITOCHU Cyber & Intelligence Inc.

12

Prevent unauthorized login
Unauthorizedlogin✓ Use conditional access policy to allow sign-ins only from devices that are hybrid-joined to Entra ID or
managed by Intune and have passed compliance checks.
License: Entra ID Premium P1, Intune✓ Use conditional access policy to require strong authentication methods (Windows Hello for Business,
FIDO2 security key, etc.) for sign-ins.
License: Entra ID Premium P1, Device with string auth methods

Reference: Conditional Access authentication strength
https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-strengths
ITOCHU Cyber & Intelligence Inc.

13

Log Collection & Investigation

ITOCHU Cyber & Intelligence Inc.

14

Log Collection & Investigation

Log
Log
Collection Investigation

Here are common problems in incident response:• Unclear what logs are needed• Logs are not being stored• Don’t know how to investigate it• Found attacker’s trace, but don’t know how to respondLet’s organize the necessary logs, retention periods,
and investigation and response policies.

ITOCHU Cyber & Intelligence Inc.

15

Log Collection

Log
Collection

Logs for investigation
Log type

Purpose

Entra ID Sign-in logs

Check for suspicious sign-ins and source IP addresses.

Entra ID Audit logs

Check for suspicious activities.
e.g. Register security information or apps

Unified Audit Log

Identify suspicious email and file-related activities for specific users.

ITOCHU Cyber & Intelligence Inc.

16

Log Collection

Log
Collection

Log type and license-specific data retention periods

7 days

Entra ID Logs

Unified Audit Log

Free

30 days

180 days

10 years

P1 & P2
Standard

Premium

References
Microsoft Entra data retention: https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-reports-data-retention#activity-reports
Default audit log retention policy: https://learn.microsoft.com/en-us/purview/audit-log-retention-policies#default-audit-log-retention-policy
ITOCHU Cyber & Intelligence Inc.

17

Log Investigation

Log
Investigation

Recommended investigation scope for log types
Microsoft Entra ID

AttackerCompromised
user
Unified Audit Log

Entra ID Logs

ITOCHU Cyber & Intelligence Inc.

18

Log Investigation

Log
Investigation

Points✓ Be aware of the licenses and log retention periods in advance!
✓ It is also a good idea to start the exploration from known intrusions.

▼ Reference
Log type

PurposeScope

Check for suspicious sign-ins and source
IP addresses.

Entire tenant

Entra ID Audit logs

Check for suspicious activities.
e.g. Register security information or apps

Entire tenant

Unified Audit Log

Identify suspicious email and file-related
activities for specific users.

Specific user

Entra ID Sign-in logs

ITOCHU Cyber & Intelligence Inc.

LicenseData Retention

Free

7 daysP1

30 daysP2

30 days

As above

As above

Audit (Standard)

180 days

Audit (Premium)10 years
19

DEMO

Entra ID Audit Logs Collection & Investigation

ITOCHU Cyber & Intelligence Inc.

20

DEMO

Entra ID Audit Logs Collection & Investigation✓ Identify and respond to intrusion• Detect suspicious security info → delete it• Detect suspicious application → disable it, check this contents

ITOCHU Cyber & Intelligence Inc.

21

Attack traces 1,2: User registered security info, device
We found following attacks in real incidents:*Device registration was not covered in this demo, but it has been seen in the past.

User registeredsecurity info
Register device

Attacker’s goal
✓ User registered security info
Even after the Session Cookie is invalidated, unauthorized sign-ins can still use MFA device.
✓ Register device
Attackers can access high-value assets that are limited to Entra ID-registered devices.
ITOCHU Cyber & Intelligence Inc.

22

Prevent user from registering security info
User Registeredsecurity info

✓ Use conditional access policy to block or require MFA for security info registration from anywhereother than a "trusted location".
*Users who are not registered with security info (multi-factor authentication) will be locked out.
License: Entra ID Premium P1

Reference: Enable combined security information registration in Microsoft Entra ID
https://learn.microsoft.com/en-us/entra/identity/authentication/howto-registration-mfa-sspr-combined#create-a-policy-to-require-registration-from-a-trusted-location
ITOCHU Cyber & Intelligence Inc.

23

Attack traces 3: Add application
Real incidents have shown the following attacks:*We only collected Unified Audit Log in this real incident due to data retention period.

Add application

Attacker’s goal
✓ Information can be stolen depending on the API permissions of the app.
ITOCHU Cyber & Intelligence Inc.

24

Attack traces 3: Add application
Microsoft 365 Environment

Corporate Resource

Compromiseduser

Suspicious
apps✓ We found the following [Manifest] in theapp registration in the real incident.

ITOCHU Cyber & Intelligence Inc.

25

Prevent add applicationAddapplication✓ Prevent general users from “Add application”• In the Azure portal, set "Users can register applications" to "No".

License: Entra ID Free
✓ Do not allow general users from “Consent to application”• Do not allow general users to register service principals to [Enterprise Applications] by granting consent.
• In the Azure portal, at [Enterprise Applications] > [User consent settings], set “Do not allow user consent”.

License: Entra ID Free
Reference:
To disable the default ability to create application registrations or consent to applications
https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/delegate-app-roles#to-disable-the-default-ability-to-create-application-registrations-or-consent-toapplications
Applications that are not known to administrators are added to enterprise applications!
https://jpazureid.github.io/blog/azure-active-directory/enterpriseapps-multitenantapps/
ITOCHU Cyber & Intelligence Inc.

26

Prevent add application
Add application

ITOCHU Cyber & Intelligence Inc.

27

Unified Audit Log Chapter

Log Collection & Investigation

ITOCHU Cyber & Intelligence Inc.

28

Log collection – Unified Audit Log

Log
Collection• Log types for Unified Audit Log *Excerpt#

RecordType

Description

1

ExchangeAdmin

Events from the Exchange admin audit log.

2

ExchangeItem

Events from an Exchange mailbox audit log for single-item actions, such as creating or
receiving an email message.

3

ExchangeItemGroup

Events from an Exchange mailbox audit log for multi-item actions, such as moving ordeleting one or more email messages.

4

SharePoint

SharePoint events.

6

SharePointFileOperation

SharePoint file operation events.

7

OneDrive

OneDrive for Business events.

8

AzureActiveDirectory

Microsoft Entra events.

15

AzureActiveDirectoryStsLogon

Microsoft Entra events.

Reference:
AuditLogRecordType https://learn.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-schema#auditlogrecordtype
ITOCHU Cyber & Intelligence Inc.

29

Log investigation – Unified Audit Log

Log
Investigation• Data Scheme

Many UALs have the following common fields:
RecordType, CreationDate, UserIds, Operations,AuditData, ResultIndex, ResultCount, Identity,
IsValid, ObjectState

AuditData is JSON,
so PowerQuery is required to parse it if necessary.

ITOCHU Cyber & Intelligence Inc.

30

Log collection – Unified Audit Log

Log
Investigation

Points✓ Prioritize and investigate RecordType based on characteristic attack methods.

<How to get>✓ GUI:
1. Go to Microsoft Purview (https://compliance.microsoft.com/ ) and navigate to [Solutions | Audit].
2. Specify the information you want to get in [Activities] and [Users], and click [Search].
3. Click [Completed] to export the results.
✓ Exchange PowerShell:
1. Connect to Exchange PowerShell
2. Use the Search-UnifiedAuditLog cmdlet to download a CSV file of UAL to your local computer.
Reference:
Audit New Search: https://learn.microsoft.com/en-us/purview/audit-new-search#get-started-with-audit-new-search
Use a PowerShell script to search the audit log: https://learn.microsoft.com/en-us/purview/audit-log-search-script
ITOCHU Cyber & Intelligence Inc.

31

DEMO

Unified Audit Log Collection and investigation

ITOCHU Cyber & Intelligence Inc.

32

DEMO

Unified Audit Log Collection and investigation✓ Identify intrusion
Priority

RecordType

Verification

1

ExchangeAdmin

Inbox-Rule created or deleted?

2

ExchangeItem

Unusual email reading/deletion activities?

2

SharePointFileOperation

Unusual File (SharePoint, OneDrive) reading/deletion activities?

✓ Investigate other intrusion• Identifying attacker activity that crosses
RecordType based on “SessionId”✓ Response• If you find suspicious Inbox-Rule→ User Interview, delete it.

ITOCHU Cyber & Intelligence Inc.

33

Attack traces 4,5: Deletion of attack traces ~ Info theft
We found the following attack traces in the Unified Audit Log by real incidents:

Create Inbox-Rule

Attacker’s goal
Sending spam
Delete Inbox-Rule
Delete email
Email theft
File theft✓ Deletion of attack traces• To prevent the intrusion from being noticed,
use a mail forwarding rule (Inbox Rule) tomove spam or bounce mail to the trash.
• Delete information inconvenient tosubsequent attacks.
✓ Info theft• Use for subsequent attacks such as BEC.

ITOCHU Cyber & Intelligence Inc.

34

Attack traces 4: Deletion of attack traces

Create Inbox-RuleSending spam
Delete Inbox-Rule
Delete email
Email theft
File theft

ITOCHU Cyber & Intelligence Inc.

35

Attack traces 4: Deletion of attack traces

Create Inbox-Rule"Parameters": [{"Name": "MoveToFolder","Value": "Deleted Items"
InboxRule:},automatically forward replies to spam emails sent{
Delete Inbox-Rule"Name": "Name",by attackers to the deleted folder"Value": ".."},
→Prevent users from noticing the intrusion{
Delete email"Name": "SubjectOrBodyContainsWords","Value": "Re: <spam mail title>"},{"Name": "MarkAsRead",
Email theft"Value": "True"},{"Name": "StopProcessingRules",File theft"Value": "False"}]

Sending spam

ITOCHU Cyber & Intelligence Inc.

36

Attack traces 4: Deletion of attack traces

Create Inbox-RuleSending spam
Delete Inbox-Rule
Delete email
Email theft
File theft

ITOCHU Cyber & Intelligence Inc.

37

Attack traces 4: Deletion of attack traces
Check and restore “AffectedItems”{"CreationTime": "2023-05-25T19:43:14","Id": "0xxx0x0x-0000-0x00-0xxx-00xx0x0000x0",[...skipped...]"SessionId": "0x000x00-xx0x-000x-00x0-00x00000x0x0","AffectedItems": [{"Id": "RgAAAADTH2BwALBELd3a¥/PAAEMAD+¥/Fm4QEc4X¥/WhbAAJ","InternetMessageId": "<G0005BE026CBF00X0X@S000A3.xxxxxx00.prod.outlook.com>","ParentFolder": {"Id": "AAAADTH2BwALBELd3a¥/PAAEMAA","Path": "¥¥Inbox"},"Subject": "Outlook Rules Organizer"}],"CrossMailboxOperation": false,"Folder": {"Id": "LgAAAADTH2BwALBELd3a¥/PAAEMAA","Path": "¥¥Inbox"}

Create Inbox-RuleSending spam
Delete Inbox-Rule
Delete email
Email theft}

File theft

ITOCHU Cyber & Intelligence Inc.

38

Attack traces 4: Deletion of attack traces

Create Inbox-RuleSending spam
Delete Inbox-Rule
Delete email
To identify attacker activities, use properties such as“SessionId" and "ClientIP“, "ClientInfoString".
* Similar to attack traces of "Info theft"

Email theft
File theft

ITOCHU Cyber & Intelligence Inc.

39

Attack traces 4,5: Deletion of attack traces ~ Info theft
Other than the “SessionId”, you can distinguish between the activities of attackers and general users:

Create Inbox-Rule✓ exs. general user activities✓ exs. attacker activities{{"CreationTime": "2023-05-27T06:12:43",

Sending spam
Delete Inbox-Rule
Delete email
Email theft"CreationTime": "2023-05-27T06:12:43",[...skipped...]"Workload": "Exchange","ClientIP": "20.100.101.102","UserId": "user@example.com","ClientIPAddress": "203.0.113.0","ClientInfoString":"Client=MSExchangeRPC","ClientProcessName": "OUTLOOK.EXE","ClientRequestId": "{00X0XXXX-000X-0X000X00-X00X0XXXX000}","ClientVersion": "16.0.16327.20200","ExternalAccess": false,[...skipped...]"Workload": "Exchange","ClientIP": “20.100.101.102","UserId": "user@example.com","AppId": "00000002-0000-0ff1-ce00000000000000","ClientIPAddress": "20.100.101.102","ClientInfoString":"Client=OWA;Action=ViaProxy","ExternalAccess": false,[...skipped...]}[...skipped...]File theft}

ITOCHU Cyber & Intelligence Inc.

40

Reporting

ITOCHU Cyber & Intelligence Inc.

41

Report writing

ReportingIn addition to analyzing incidents, it is important to accurately communicate the results and remaining
actions to users.
We detected following suspicious activity in your logs, Please confirm whether these were expected and check the following action
items:
1. Suspicious sign-in
Between 13:50:17 and 14:11:43 UTC on December 12, 2023, we observed suspicious sign-ins to Johanna's account from thefollowing user agent and IP address:
Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0
2a0b:f4c2:1::1 , , US
54.36.108.162 Saarbruecken, Saarland, DE … etc
2. Account activity
Between 13:55:36 and 14:04:58 UTC on December 12, 2023, the following activities were performed on Johanna's accountwith her permissions:• Added the following application:
1. Summary of the intrusion
TargetDisplayName: chatbot
TargetObjectId: 80cf2cdc-2178-400b-ab98-a0677b6bd694• Delegated the following permissions to the application:
ConsentType: AllPrincipals
Scope: Mail.ReadWrite MailboxSettings.ReadWrite User.Read
3. Security info
The following security information was registered on Johanna‘s account . . .
4. Mail forwarding rules
The following mail forwarding rules were created on Johanna's account . . .
ITOCHU Cyber & Intelligence Inc.

42

Report writing

ReportingIn addition to analyzing incidents, it is important to accurately communicate the results and remaining
actions to users.
5.

Suspicious Activity by Johanna’s accountSent an email titled "REVISED INVOICE" at 5:03 UTC on December 12, 2023.
Downloaded the following information between 5:12:10 and 5:15:38 UTC on December 12, 2023:
PO_EcoGreenLand_inc.docx
Comprehensive ERP System Requirements.docx

We have confirmed that the following actions have been taken for each activity:• Disabled the suspicious application• Deleted the suspicious security information• Deleted the suspicious mail forwarding rules

2. Summary of incident response activities

We would like you to take the following actions:• Delete the suspicious application• Issue a company-wide notification about the downloaded information and sent email
Thank you for your time and attention.

3. Request for additional action

ITOCHU Cyber & Intelligence Inc.

43

Defensive Measures

ITOCHU Cyber & Intelligence Inc.

44

Incident Flow

User

Received
Phishing mailEntered ID, PW, MFA
on a phishing site

Sending mass
spam emails

Session Cookie Theft

Attacking other organizations

Mail sample

Attacker

0

1

2

3

4

5

Unauthorized
login

Registersecurity info

RegisterdeviceAddapplication

Deletion of
attack traces

Info theft

Microsoft
365

Entra ID Sign-in Log

Entra ID Audit Log* If you have E5 or Entra ID Premium P2, it is recommended to check Identity Protection alerts before Entra ID Logs.
* Unified Audit Log provides all the necessary attacker's traces, but we sometimes use Entra ID Logs for general incident checking.

ITOCHU Cyber & Intelligence Inc.

Unified Audit Log*

45

Defensive Measures

Defensivemeasures

The following prevent, containment, and detect measures were introduced:

User

Attacker

Microsoft
365

Received
Phishing mailEntered ID, PW, MFA
on a phishing site

Sending mass
spam emails

Session Cookie
Theft

Attackingother organizations

0

1

2

3

4

5

Unauthorized
login

Registersecurity info

RegisterdeviceAddapplication

Deletion of
attack traces

Info theft

Prevent +Containment

Prevent

ITOCHU Cyber & Intelligence Inc.

Detect46

Summary

ITOCHU Cyber & Intelligence Inc.

47

* It does not cover all possible attack scenarios. There have been reports of APTs using methods not listed below, such as abusing Power Platform, First Party Apps, and inviting guest users.

Initial Response is most important!
Open
Entered ID,
phishing mail PW, MFA

Session Unauthorized
Register
Cookie Theftlogin
security info

RegisterdeviceAddapplication

Deletion of
attack traces

Info theft

1. Disable sessions if they are still active.
2. Reset the password of the compromised user.
3. Delete suspicious security info from the compromised user.
4. Disable suspicious registered devices.

5. Delete suspicious mail forwarding rules.

Repeat

6. Disable Entra ID apps that were registered before orafter the intrusion.

7. Request, collect, and investigate logs.
8. Investigate other recipients of the intrusion-starting email.
9. Investigate suspicious sign-ins before and after receiving theemail to identify other compromised users.
ITOCHU Cyber & Intelligence Inc.

48

Summary
It covered the following topics based on a real-world M365 account intrusion incident:• Initial response to an incident

The goal:• Key points of incident investigation• Details of attacker traces and associated logs

✓ Understand the key points ofincident response for quickly andeffectively✓ Understand effective defense
measures• Incident prevention

ITOCHU Cyber & Intelligence Inc.

49

Thank you

ITOCHU Cyber & Intelligence Inc.

Appendix: Reference of Initial Response

ITOCHU Cyber & Intelligence Inc.

51

* It does not cover all possible attack scenarios. There have been reports of APTs using methods not listed below, such as abusing Power Platform, First Party Apps, and inviting guest users.

Summary of Initial Response
Open
Entered ID,
phishing mail PW, MFA

Session Unauthorized
Register
Cookie Theftlogin
security info

RegisterdeviceAddapplication

Deletion of
attack traces

Info theft

1. Disable sessions if they are still active.
2. Reset the password of the compromised user.
3. Delete suspicious security info from the compromised user.
4. Disable suspicious registered devices.

5. Delete suspicious mail forwarding rules.

Repeat

6. Disable Entra ID apps that were registered before orafter the intrusion.

7. Request, collect, and investigate logs.
8. Investigate other recipients of the intrusion-starting email.
9. Investigate suspicious sign-ins before and after receiving theemail to identify other compromised users.
ITOCHU Cyber & Intelligence Inc.

52

Details of Initial Response
1. Disable sessions if they are still active.

• Access the Azure Portal (https://portal.azure.com/ ) with an account with user administrator or higher
permissions.
• Search for the compromised user in [Microsoft Entra ID] - [Users] and navigate to the user screen.
• Perform [Revoke sessions]. *Confirm that Continuous Access Evaluation is enabled in advance.

2. Reset the password of the compromised user.

• Similarly, perform [Reset password] on the user screen.

3. Delete suspicious security info from the compromised user.

• Switch to the [Authentication methods] section on the user screen.
• Check for suspicious security information in “Usable authentication methods".
• If found, click […] - [Delete] in order.

4. Disable suspicious registered devices.

• Switch to the [Devices] section on the user screen.
• Select a suspicious device and click [Disable].

ITOCHU Cyber & Intelligence Inc.

53

Details of Initial Response
5. Delete suspicious mail forwarding rules.
• Import the ExchangeOnlineManagement module on the connecting PC in advance.
Import-Module ExchangeOnlineManagement• Connect to Exchange Online using PowerShell.
Connect-ExchangeOnline -UserPrincipalName admin@example.com• Check for existing InboxRules about compromised user.
Get-InboxRule -Mailbox Joker@example.com• Remove suspicious InboxRules about compromised user.
Remove-InboxRule -Mailbox Joker@example.com -Identity "ProjectA-MoveToFolderA“

6. Disable Entra ID apps that were registered before or after the intrusion.
• Access the Azure Portal (https://portal.azure.com/ ) with an account with application viewer or higher
permissions.
【Enterprise applications】• Navigate to [Microsoft Entra ID] - [Enterprise applications] - [All applications].
• Sort by [Add filters] - [Created on == Last 7 days (*reference)] and check if there are any new app registrations before
and after the incident, if any, select it.
• Switch to the [Properties] section and set “Enable for users to sign-in?" to "No".
• Delete apps after the incident response is complete. (Cont.)

ITOCHU Cyber & Intelligence Inc.

54

Details of Initial Response
6. (Cont.) Disable Entra ID apps that were registered before or after the intrusion.
• Access the Azure Portal (https://portal.azure.com/ ) with an account with application viewer or higher
permissions.
【App registrations】
•
•
•
•
•

Navigate to [Microsoft Entra ID] - [App registrations] - [All applications].
Sort by [Created on] for apps created before and after the incident, if there are any suspicious apps, select them.
Switch to the [Certificates & secrets] section and delete the secret if any.
Switch to the [API permissions] section and delete suspicious permissions.
Delete apps after the incident response is complete.

7. Request, collect, and investigate logs.
【 Entra ID Logs 】• Access the Azure Portal (https://portal.azure.com/ ).
• Navigate to [Microsoft Entra ID] - [Monitoring] - [Sign-in logs] or [Audit logs] and click [Download].

【 Unified Audit Log 】• Connect to Exchange Online using PowerShell.
• Use Search-UnifiedAuditLog to get logs. (Cont.)

ITOCHU Cyber & Intelligence Inc.

55

Details of Initial Response
7. (Cont.) Request, collect, and investigate logs.
【 Unified Audit Log 】• The following is a reference example that outputs multiple RecordTypes in bulk.
$recordTypes = @("ExchangeAdmin", "ExchangeItem", "ExchangeItemGroup", "AzureActiveDirectory","AzureActiveDirectoryStsLogon", "SharePoint", "SharePointFileOperation", "OneDrive")$startDate = "12/1/2023“$endDate = "12/14/2023" $userId = Joker@example.com$resultSize = 5000 $outputPath = "/Users/admin/file/UAL/JohannaL_UAL.csv“foreach ($recordType in $recordTypes){ $auditlog = Search-UnifiedAuditLog -UserIds $userId -ResultSize $resultSize -StartDate $startDate -EndDate$endDate -RecordType $recordType $auditlog| Select-Object -Property CreationDate,UserIds,RecordType,Operations,AuditData| Export-Csv -Append -Path $outputPath -NoTypeInformation -Force }8. Investigate other recipients of the intrusion-starting email.

• Access Microsoft Defender (https://security.microsoft.com/ ).
• Navigate to [Email & collaboration] - [Explorer].
• Investigate whether there are any users who have received similar emails to the compromised user.

9. Investigate suspicious sign-ins before and after receiving the email to identify other compromised
users.
ITOCHU Cyber & Intelligence Inc.

56

Appendix: List of defensive measures* Includes a restatement of defenses mentioned within the slides of this volume.

ITOCHU Cyber & Intelligence Inc.

57

* It does not cover all possible attack scenarios. There have been reports of APTs using methods not listed below, such as abusing Power Platform, First Party Apps, and inviting guest users.

Defensive Measures

User

Attacker

Microsoft
365

Received
Phishing mailEntered ID, PW, MFA
on a phishing site

Sending mass
spam emails

Session Cookie
Theft

Attackingother organizations

0

1

2

3

4

5

Unauthorized
login

Registersecurity info

RegisterdeviceAddapplication

Deletion of
attack traces

Info theft

Prevent +Containment

Prevent

ITOCHU Cyber & Intelligence Inc.

Detect58

Prevent
Session Cookie
Theft✓ Use conditional access policy to allow use tokens only from devices on which they were issued.
* This feature is still in preview and is only available in Office 365 Exchange Online and Office 365 SharePoint Online.

License: Entra ID Premium P2
Policy settings:• [Assignments]• [Users]: [Include] “All users” or “Select users and groups” *Exclude break glass accounts.
• [Target resources] - [Cloud apps]: Office 365 Exchange Online, Office 365 SharePoint Online• [Access controls] - [Session]: Require token protection for sign-in sessions (Preview)

Reference:
Conditional Access: Token protection (preview) https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-token-protection
ITOCHU Cyber & Intelligence Inc.

59

Containment
Session Cookie
Theft✓ Limit the session duration of Outlook on the Web (OWA) to 1 hour.
• The non-persistent session token issued by Microsoft Entra ID for accessing OWA is 24 hours by default, so
create a conditional access policy to require reauthentication after 1 hour.

License: Entra ID Premium P1
Policy settings:• [Assignments]• [Users]: [Include] “All users” or “Select users and groups” *Exclude break glass accounts.
• [Target resources] - [Cloud apps]: Office 365 Exchange Online• [Conditions] - [Client apps]: Browser• [Access controls] - [Session]: [Sign-in frequency] - [Periodic reauthentication = 1 Hours]

Reference: Configure authentication session management with Conditional Accesshttps://learn.microsoft.com/en-us/entra/identity/conditional-access/howto-conditional-access-session-lifetime#policy-1-sign-in-frequency-control
ITOCHU Cyber & Intelligence Inc.

60

Prevent
Unauthorizedlogin✓ Use conditional access policy to allow sign-ins only from devices that are hybrid-joined to Entra ID or
managed by Intune and have passed compliance checks.
License: Entra ID Premium P1, Intune
Policy settings:• [Assignments]• [Users]: [Include] “All users” or “Select users and groups” *Exclude break glass accounts.
• [Target resources] - [Cloud apps]: All cloud apps
• [Access controls] - [Grant] - [Grant access]:“Require device to be marked as compliant” or “Require Microsoft Entra hybrid joined device”

ITOCHU Cyber & Intelligence Inc.

61

Prevent
Unauthorizedlogin✓ Use conditional access policy to require strong authentication methods (Windows Hello for Business,
FIDO2 security key, etc.) for sign-ins.
License: Entra ID Premium P1, Device with string auth methods
Policy settings:• [Assignments]• [Users]: [Include] “All users” or “Select users and groups” *Exclude break glass accounts.
• [Target resources] - [Cloud apps]: All cloud apps
• [Access controls] - [Grant] - [Grant access]: “Require authentication strength”

Reference:
Conditional Access authentication strength: https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-strengths
ITOCHU Cyber & Intelligence Inc.

62

Detect
Unauthorizedlogin✓ Detect accesses from two or more countries within 10 minutes (as a guide) in Entra ID Interactive
Sign-in logs.
License: Entra ID Free + SIEM
✓ Send an alert to administrators if the sign-in risk is medium or higher in Entra ID Identity Protection.
License: Entra ID Premium P2

ITOCHU Cyber & Intelligence Inc.

63

Prevent
User Registeredsecurity info

✓ Use conditional access policy to block or require MFA* for security info registration from anywhereother than a "trusted location".
*Users who are not registered with security info (multi-factor authentication) will be locked out.
*You can require not only MFA but devices to be marked as compliant or to have joined Microsoft Entra.

License: Entra ID Premium P1
Policy settings:• [Assignments]• [Users]: [Include] “All users” or “Select users and groups” *Exclude break glass accounts.
• [Target resources] - [User actions]: Register security information• [Conditions] – [Locations]: Exclude trusted locations.
• [Access controls] - [Grant] - [Grant access]: Require your favorite options (e.g., MFA, device to be marked ascompliant).

Reference: Enable combined security information registration in Microsoft Entra ID
https://learn.microsoft.com/en-us/entra/identity/authentication/howto-registration-mfa-sspr-combined#create-a-policy-to-require-registration-from-a-trusted-location
ITOCHU Cyber & Intelligence Inc.

64

Detect
User Registeredsecurity info

✓ Export Entra ID audit logs to SIEM and monitor the following attributes.
License: Entra ID Free + SIEM
Service

Authentication Methods

ServiceAzure MFA

Category

UserManagement

Category

UserManagement

Activity

User registered security info

Activity

User changed default security info
User started security info registration
User registered security info
User updated security info
User deleted security info

Results

Success / Failure

Results

Success / Failure

ITOCHU Cyber & Intelligence Inc.

65

Prevent
Registerdevice✓ Use conditional access policy to block or require MFA* for device registration from anywhere otherthan a "trusted location".
*You can require not only MFA but devices to be marked as compliant or to have joined Microsoft Entra.

License: Entra ID Premium P1
Policy settings:• [Assignments]• [Users]: [Include] “All users” or “Select users and groups” *Exclude break glass accounts.
• [Target resources] - [User actions]: Register or join devices• [Conditions] – [Locations]: Exclude trusted locations.
• [Access controls] - [Grant] - [Grant access]: Require your favorite options (e.g., MFA, device to be marked ascompliant).

Reference:
Conditional Access: Target resources - User actions: https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-cloud-apps#user-actions
ITOCHU Cyber & Intelligence Inc.

66

Detect
Registerdevice✓ Send device registration notifications to users.
In the Intune admin center, set up enrollment notifications for newly registered devices to users.
This will allow users to be aware of any unexpected device registrations and contact IT administrators.

License: Entra ID Premium P1 + Intune

Reference:
Set up enrollment notifications https://learn.microsoft.com/en-us/mem/intune/enrollment/enrollment-notifications
ITOCHU Cyber & Intelligence Inc.

67

Detect
Registerdevice✓ Export Entra ID audit logs to SIEM and monitor the following attributes.
License: Entra ID Premium P1+ SIEM
Service

Device Registration Service

Category

DeviceActivity

Register device

Results

Success / Failure

Reference:
Set up enrollment notifications https://learn.microsoft.com/en-us/mem/intune/enrollment/enrollment-notifications
ITOCHU Cyber & Intelligence Inc.

68

Prevent
Add
application✓ Prevent general users from “Add application”• In the Azure portal, set "Users can register applications" to "No".

License: Entra ID Free
✓ Do not allow general users from “Consent to application”• Do not allow general users to register service principals to [Enterprise Applications] by granting consent.
• In the Azure portal, at [Enterprise Applications] > [User consent settings], set “Do not allow user consent”.

License: Entra ID Free

Reference:
To disable the default ability to create application registrations or consent to applications
https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/delegate-app-roles#to-disable-the-default-ability-to-create-application-registrations-or-consent-toapplications
Applications that are not known to administrators are added to enterprise applications!
https://jpazureid.github.io/blog/azure-active-directory/enterpriseapps-multitenantapps/
ITOCHU Cyber & Intelligence Inc.

69

Detect
Add
application✓ Export Entra ID audit logs to SIEM and monitor the following attributes.
License: Entra ID Free + SIEM#

Service

Category

Activity

1

Core Directory

ApplicationManagement

Add application2

Add service principal

3

UserManagement

Add app role assignment grant to user

4

ApplicationManagement

Add delegated permission grant

5Consent to application

ITOCHU Cyber & Intelligence Inc.

70

About Entra ID Audit logs output during app addition
The following is an image of the log output when an app is added in Entra ID.
* Please contact Microsoft for accurate information as this is just an image.

Microsoft Entra ID
1 Add application

Attacker

Application
30 Unauthorized access2 Add service principal

Add app role assignment
grant to user

User
4

Add delegatedpermission grantApp role
assignment

5 Consent to application

ITOCHU Cyber & Intelligence Inc.

Service
Principal

Delegated
permission

71

Detect
Deletion of
attack traces✓ Detect mail forwarding rule creation
Export the Unified Audit Log to SIEM and monitor the following attributes.
*Other traces can be seen from the Unified Audit Log are omitted because it is difficult to distinguish from normal activities.

License: Audit (Standard) + Exchange Online + SIEM
RecordType

Operation

Activity

ExchangeAdmin

New-InboxRule

Create mail forwarding rules (InboxRule)

ITOCHU Cyber & Intelligence Inc.

72

ITOCHU Cyber & Intelligence Inc.