Threat hunting in Microsoft 365

[poullam]

I'm currently pulling as much audit data as I can out of the Microsoft 365 Management API into a external logging platform (so as to correlate data with other threat intel). So far, I've found some really basic things like logon errors that helped me find a misconfigured client, but so far the data is little more than interesting/informative; I'm looking for good indicators of account compromise and malicious activity, especially in SharePoint and Exchange.

Any tips? Resources on good indicators of compromise?

I'm planning on additionally shipping the data to Azure Sentinel to evaluate whether it provides any added value.

[#2]

Well, it's been 6 months since I posted this, so I thought to update it with what has been happening recently.

• A lot of Microsoft reps touted Azure Sentinel as being a silver bullet, so I deployed Azure Sentinel and set up whatever alert policies seemed useful. So far little more than a lot of noise and false positives.
• The Azure AD Identity Protection has been the only thing so far that has produced actionable intel. Some alerts lit up and we were able to reset a few compromised user passwords.
• In terms of the celebrated ML capabilities of Azure Sentinel, I have yet to see any substantial benefit.
• Our best approach has been to pull the data in from the management API and whatever we can get our hands on with the Graph API into our own SIEM. For what we can get however, the data, queries, keywords are not consistent.
• These APIs are not as available as you would think they should be for being supported by a major tech company.

The main issue now:  a lot of lookup and remediation actions for Microsoft365 are mysteriously absent from any API (and many APIs seem to be in a weird deprecation limbo), but are mostly offered in PowerShell, which is a major hurdle for our infrastructure paradigm which focuses on event-driven containerized applications. In this I recognize my bias: coming from a Linux background I find Powershell abhorrent, but I digress...