User app registration - exploitable for BEC?

Hi underQualifried ,

You've already identified the key elements based on your description. To store your sign-in logs, audit logs, and other data, you'll need to write them to a Log Analytics workspace, which functions similarly to a database. From your error, it seems you don't have an Azure subscription yet. An Azure subscription is required to create and manage Azure resources like virtual machines, Logic Apps, or App Services. These resources need to be associated with a subscription so Microsoft can handle billing.

No worries—setting up a Log Analytics workspace isn't costly, and it's definitely worth it for its robust investigation and monitoring capabilities.

For example, I usually retain the following logs for about six months for thorough analysis and tracking:

• SignInLogs
• AuditLogs
• NonInteractiveUserSignInLogs
• ServicePrincipalSignInLogs
• ManagedIdentitySignInLogs
• EnrichedOffice365AuditLog
• MicrosoftGraphActivityLogs

If you want to see more evidence who changes your CA policies based on these log you could try the queries in this repo: https://github.com/LouisMastelinck/Monitor-security-policy-changes-or-admin-activities

An essential part of your forensics process will involve determining what actions this Enterprise Application performed. Depending on your licenses and whether you're tracking Office activity, you can use the following KQL query in Security.microsoft.com > Advanced Hunting:

CloudAppEvents
| where OAuthAppId == "" // Insert the App ID of the EIM client
| where ActionType == "MailItemsAccessed" // Look for the app accessing mail items, this can all other activities
| summarize RequestCount = count() by bin(Timestamp, 1d)
| order by Timestamp
| render timechart

This query will generate a chart showing how many emails the app accessed over time. If the app sent emails, you'll need to change the ActionType.

Another useful query to see which emails were accessed is:

CloudAppEvents
| where OAuthAppId == "this should be the app id of your eM Client" 
| where ActionType == "MailItemsAccessed"
| extend AffectedMailbox = tostring(RawEventData.UserId)
| project-reorder AffectedMailbox

Root Cause
The root cause of your Business Email Compromise (BEC) seems to be application consent granted by end users, allowing external applications to access their accounts and data. The two blog posts by Matthew Levy are excellent resources for understanding how to prevent this.