Forum Discussion

halil86's avatar
halil86
Copper Contributor
Mar 30, 2019

Office365 account compromise

Hi

 

Im doing Incident Respond for office 365 account hijacking. May i know how do i check if the hacker have download all the webmail to local computer (pst etc).

 

Is there any specific string i can filter inside the audit log.

 

Thanks

 

office 365
  • Cian Allner's avatar
    Cian Allner
    Silver Contributor
    Mar 30, 2019

    Hi, I'd start here, which is a series of steps, if you haven't seen it already, with how to deal with compromised accounts:

     

    https://docs.microsoft.com/en-us/office365/securitycompliance/responding-to-a-compromised-email-account

     

    The above article mentions checking the Audit Logs in the Security & Compliance Center and review all the activities for the suspected account

     

    "by filtering the results for the date range spanning from immediately before the suspicious activity occurred to the current date"

     

    The article also discusses checking the Azure AD Sign-in logs and other risk reports.

    • halil86's avatar
      halil86
      Copper Contributor
      Mar 30, 2019

      Cian Allner 

       

      Thanks Cian.  I had gone through the action. From the audit log, hacker got access for around 30 minutes before admin change the password. Now im looking into what is the action being perform beside sending phish link to all the contacts

Resources