HUNTING M365 INVADERS

Summary from the TLDR InfoSec newsletter

This blog post provides an overview of available data sources and methods for detecting initial access to Microsoft 365 environments. It covers how the Unified Audit Log and Azure AD logs can be utilized for detection. It then covers techniques and queries for detecting the following attack methods: password spraying, illicit consent grants, device code phishing, MFA fatigue, MFA enumeration, and adversary in the middle.