Reply to thread

Message

<blockquote data-quote="Exceedinglife" data-source="post: 1102722" data-attributes="member: 117089">Hello everyone,I deal with business email compromises pretty often. I created a script that checks an email account and I can verify if its been hit or not pretty quickly.Usually these users are not global admins, however, the other day I had 1 that was a GA and I searched the tenant.I found an email connector in exchange online, and also found an app registration allowing the APT access to the tenant and to spin up cloud resources.I checked for new VMs and didnt find anything.Does anyone have a script to check an azure tenant for malicious activity?Auditing was also not turned on on this tenant, so I enabled that right away...I&#039;m working with another company who just been ransomwared and their DFIR firm has a script to check tenants quickly if the threat actor was in it or not.Of course the script is in house and they wont share it with me, but I would love a script like that!If not I could create one, but I just need to know what I would be looking for in a tenant for malicious activity.- Sign-in Logs- App registrations- email connectors- email rules, forwarding, delegatesNot really sure what else at this point in time.Thank you all!</blockquote>

[QUOTE="Exceedinglife, post: 1102722, member: 117089"] Hello everyone, I deal with business email compromises pretty often. I created a script that checks an email account and I can verify if its been hit or not pretty quickly. Usually these users are not global admins, however, the other day I had 1 that was a GA and I searched the tenant. I found an email connector in exchange online, and also found an app registration allowing the APT access to the tenant and to spin up cloud resources. I checked for new VMs and didnt find anything. Does anyone have a script to check an azure tenant for malicious activity? Auditing was also not turned on on this tenant, so I enabled that right away... I'm working with another company who just been ransomwared and their DFIR firm has a script to check tenants quickly if the threat actor was in it or not. Of course the script is in house and they wont share it with me, but I would love a script like that! If not I could create one, but I just need to know what I would be looking for in a tenant for malicious activity. - Sign-in Logs - App registrations - email connectors - email rules, forwarding, delegates Not really sure what else at this point in time. Thank you all! [/QUOTE]

Verification