Disable the Account and Validate Compromise

#

1. Disable the account in question, change password and revoke sessions.
2. Verify account compromise.
   1. Check sign-in logs to validate odd behavior.
3. Validate that user account has not registered an application.
   1. Usually there may be tools that were registered by the attacker that are related to data recovery.
4. Check Audit log for compromised account.
5. Perform an email message trace for sent emails.
   1. The compromised accounts mailbox may also have rules created to hide the attacker.

Disable Account in Question

#

1. Navigate to https://entra.microsoft.com/
2. Expand Users > All Users and search for the account in question.
   1. Disable Account:
   2. Revoke Sessions:

      

Verify Account Compromise

#

1. Navigate to https://entra.microsoft.com/
2. Expand Users > All Users and search for the account in question.
3. Open that account and open Sign-in logs

   

4. Set Date to as long as possible.
5. Depending on licensing they may only have 7 days of logging. You can also download the log once it is loaded.
6. Be sure to also pull the non-interactive sign-ins as well and download for reporting.

   

7. Navigate to Audit logs and view/download audit logs for any changes that may have been performed.

   

Verify No Applications Have Been Registered

#

1. Within the panel of the suspect account, click on Applications and validate there are no suspicious applications that were added within the timeframe that the account was compromised.
   1. Keep in mind that legitimate applications are used for malicious purposes (such as data recovery tools).

2. If there is a suspicious application, navigate to Applications > Enterprise Applications on the left pane. ![[Pasted image 20251030081914.png]] 3. Log everything you can with screenshots such as: 1. Users and Groups it’s assigned to 2. Permissions that the application has 3. Sign-in logs 4. Audit logs

4. Once documented, you may continue with the following:
   1. Remove all users assigned to the application
   2. Revoke all permissions granted to the application
   3. Revoke refresh tokens for all users

Cleaning up Malicious Application

#

1. Within the permissions page of the application you can select Review Permissions

   

2. It will pop out a pane and you can select the following: “This application is malicious and I’m compromised”.

3. This will give you 3 PowerShell scripts to run to perform the 3 tasks we mentioned above.

   

4. Once documented and the customer is ready to, you may remove the application from the Enterprise Applications screen. You may want to leave it there for the customer to reference the logs at a later date if they involve more investigation techniques.

Diagnose Email Compromise of Suspect Account

#

1. If the customer has the licensing, they can utilize tools in the https://security.microsoft.com/ to review suspicious emails, as well as mass deleting emails from mailboxes.

Remediate Email Using Microsoft Defender XDR

#

Remediate malicious email that was delivered in Office 365 | Microsoft Learn

Remediate Email Using PowerShell

#

1. If the customer does not have Microsoft Defender, you can use the following instructions to remediate the malicious email for mailboxes within the tenant.
   1. Search for and delete email messages in your organization | Microsoft Learn

Preventative Actions

#

1. Implement MFA on all user accounts.
2. Setup Conditional Access Policies (Entra P1+ License Required)
   1. Require MFA for all users
   2. Block access from other countries
   3. Block Unapproved Device Types
   4. Disable Persistent Browser Session
   5. Require App Protection Policy (If using Intune)
   6. Block legacy authentication (Don’t enable if customer is using SMTP Authentication)
   7. Require MFA to Join to Entra (If using Intune)
3. Harden Tenant Settings

Harden User Settings

#

Harden Group Settings

#

Require Admin Consent for registering applications.

#

This can be set up so a group of admins will receive an email when a user attempts to register an application to the tenant.

1. Navigate to Entra > Applications > Enterprise Applications > Consent and Permissions
2. Most Restrictive: Change to force administrator approval for all applications

   

3. Set up users who will be able to approve and deny consent requests.