Investigating M365 Entra

Investigating M365 / Entra Incidents

A Microsoft 365 compromise usually leaves no host to image — the crime scene is entirely in the cloud logs. An attacker who phishes a session token or tricks a user into consenting a malicious OAuth app does not need malware: they read mail, set a hidden forwarding rule, and pivot to invoice fraud, and every step is a record in the Unified Audit Log (UAL), the Entra sign-in logs, or the mailbox configuration. The investigator reconstructs the takeover from those records. The urgency is twofold: UAL retention is finite, and any forwarding or inbox rule the attacker set is still exfiltrating mail while you investigate.

Confirm the tenant is in scope per [AGENTS.md](../../AGENTS.md). Enable/confirm UAL access early and export the relevant window before retention lapses. This is read-only investigation; disabling the account, revoking sessions, or removing a malicious app is the operator's containment call.

When to Use

• A suspected M365/Entra account takeover or business email compromise (BEC)
• No disk or memory to image — only cloud logs (UAL, sign-ins, OAuth grants)
• Hunting hidden inbox/forwarding rules and delegate/permission changes
• Investigating malicious OAuth app consent as a persistence and exfil path
• Reconstructing token/session theft that bypassed MFA

When NOT to Use

• Azure resource control plane (subscriptions, RBAC, Key Vault, VMs) — use investigating-azure-incidents; this skill is the M365 workload and identity layer
• AWS or GCP — use investigating-aws-incidents or investigating-gcp-incidents
• On-host artifacts — use investigating-windows-endpoints
• Triaging the phishing email that started it — use analyzing-phishing-emails
• Proactive search with no incident yet — use hunting-threats
• Running the whole incident — use responding-to-incidents
• Packaging IOCs into a product — use producing-threat-intelligence

Reconstruct from the Cloud Logs

Unified Audit Log is the backbone. Search it for the suspect user and window:

Search-UnifiedAuditLog -StartDate 2026-08-01 -EndDate 2026-08-08 `
  -UserIds victim@corp.com -ResultSize 5000 |
  Where-Object Operations -in `
    'New-InboxRule','Set-InboxRule','Set-Mailbox','Add-MailboxPermission',
    'Consent to application','Add service principal','UserLoggedIn' |
  Export-Csv ual_victim.csv -NoTypeInformation

Then correlate across the layers:

• Mailbox rules (the BEC signature). Hidden inbox/forwarding rules that move

or delete mail to a folder like RSS or Archive: Get-InboxRule -Mailbox victim@corp.com and UAL New-InboxRule/Set-InboxRule; external forwarding via Set-Mailbox -ForwardingSmtpAddress (T1114.003). These are how invoices get intercepted — find and time them precisely.

• Delegation / permissions. Add-MailboxPermission, Add-RecipientPermission

granting the attacker standing access without the victim's password.

• OAuth app consent (persistence that survives a password reset and MFA).

UAL Consent to application / Add app role assignment and Entra enterprise-app consent grants — a malicious app with Mail.Read/Mail.Send is durable access; treat consented apps as identity persistence (T1528).

• Sign-ins. Entra sign-in logs for the session behind the changes: source IP,

ASN, device, MFA state, and legacy-auth or token-replay indicators (impossible travel, a new device satisfying no MFA). A "successful, low-risk" sign-in can still be stolen-token access.

Rationalizations to Reject

• "MFA was on, so it wasn't takeover." Token/session theft and consent phishing bypass MFA entirely. Check the sign-in method and consented apps, not just the MFA flag.
• "No malware, so no incident." BEC is malware-free by design. The evidence is rules, consents, and sign-ins, not a binary.
• "Removed the forwarding rule, done." Removal is containment. Establish what was exfiltrated, which sessions/apps still have access, and the full timeline first.
• "One suspicious login, case closed." Follow the app consents and delegated permissions — the durable foothold often outlives the login.
• "UAL will still be there next week." Retention is finite and auditing may have been off. Preserve the window now.

Deliverable

# M365/Entra Investigation    Date:    Analyst: 
Tenant / scope:   
Window:              UAL/audit state: 
Entry:            
Sign-in evidence: 
Mailbox changes:  
OAuth consents:   
Data exposed:     
Timeline:         
Conclusion:       compromised / not / could-not-determine  Confidence: <>

Save UAL/sign-in exports as {tool}_{tenant}_{YYYYMMDD_HHMMSS}.csv and log identities/IOCs via maintaining-engagement-state. ATT&CK IDs common here (T1078.004 Valid Cloud Accounts, T1114.003 Email Forwarding Rule, T1528 Steal Application Access Token, T1556 Modify Authentication Process, T1098.003 Additional Cloud Roles) — re-verify before citing.

References

• investigating-azure-incidents — the Azure resource control plane beside this identity/workload layer
• analyzing-phishing-emails — the lure that usually starts a BEC
• responding-to-incidents — the incident this feeds
• producing-threat-intelligence — packaging the actor infrastructure and IOCs
• Unified Audit Log (Search-UnifiedAuditLog), Exchange Online PowerShell (Get-InboxRule), Entra sign-in/audit logs, Microsoft Sentinel (KQL)

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: EvilFreelancer
• Source: EvilFreelancer/secs
• License: Apache-2.0

Install and usage instructions live in the source repository linked above.