The Silent Heist: How to Forensically Hunt Compromised Microsoft 365 & Entra ID Accounts

Picture this: It is late Friday evening. A standard user in your corporate finance department receives an urgent, convincing phishing email, enters their credentials into a rogue authentication page, and approves a rogue multi-factor prompt. No malware is ever downloaded to their laptop. No suspicious executable runs on their hard drive.

Welcome to modern cloud-native compromise. In Microsoft 365 and Entra ID environments, threat actors don't need to break windows or drop ransomware binaries on endpoints. They simply log in through the front door using stolen credentials, slip quietly into the cloud, and establish persistence. If your incident response team is only looking for traditional malware signatures, you are entirely missing the ghost in the machine. Let’s walk through a practitioner's playbook for forensically auditing compromised cloud identities.

Step 1: Mining the Unified Audit Log (UAL)

When an investigator suspects an M365 breach, the very first place to look is the Unified Audit Log. Unfortunately, default retention settings in many tenants can be frustratingly short unless enterprise logging policies are actively enforced.

When you query the UAL—either natively via the Microsoft Purview compliance portal or programmatically using Exchange Online PowerShell—you aren't just looking for successful logins. You are hunting for behavioral anomalies:

• Impossible Travel and Strange User Agents: Spotting an account authenticating from a residential VPN IP address in Eastern Europe two minutes after logging in from a corporate office in Chicago.
• Mass Item Access: Attackers using automated scripts to export hundreds of emails or download sensitive OneDrive documents in seconds.
• Inbox Rule Creation: Threat actors frequently create hidden inbox rules that automatically delete or move incoming emails from IT or security alerting channels to obscure folders, keeping the victim completely blind to ongoing BEC (Business Email Compromise) activity.

Step 2: Uncovering Malicious OAuth Enterprise App Grants

One of the most cunning persistence techniques in modern cloud attacks is the abuse of OAuth permissions. Instead of constantly stealing passwords, an attacker tricks a user into granting a malicious third-party app broad permissions (such as Mail.ReadWrite or Directory.Read.All).

Even if the user changes their password or resets their MFA tokens, the rogue application retains independent API access to the mailbox and directory via its own granted tokens. Investigators must inspect the Entra ID portal to audit all registered enterprise apps, check for unverified publisher names, and immediately revoke any suspicious application permissions.

Step 3: Stopping the Bleeding and Revoking Tokens

Once you have scoped the blast radius, you need to evict the adversary immediately. Simply disabling the user account or forcing a password reset is often not enough because existing session tokens and refresh tokens can remain valid for hours.

To cut off access instantly, administrators must execute a full token revocation routine via Microsoft Entra PowerShell using commands like Revoke-AzureADUserAllRefreshToken. This forces every active session across all devices and API connections to re-authenticate from scratch, neutralizing the attacker's foothold.

By shifting your forensic mindset from local endpoints to cloud identity logs, your team can hunt down sophisticated threat actors who rely on stealth rather than malware.

References & Further Reading

• Microsoft Learn: Search the Unified Audit Log in Microsoft Purview
• Microsoft Entra Documentation: Managing Consent and OAuth Application Permissions
• CISA Cybersecurity Guidance: Detecting and Mitigating Cloud Compromises
• Microsoft Graph PowerShell SDK: Revoking User Refresh Tokens
• Microsoft Security Blog: Investigating Business Email Compromise (BEC) Trends