Defending Entra ID and Office 365 Using the Prism of GraphRunner

The talk looks at how an attacker can use the Microsoft Graph API against Microsoft Entra ID and Office 365 tenants, and which log sources expose that activity. The speaker uses GraphRunner, an open-source red team toolkit released by Black Hills Information Security, to run a simulated attack chain and then examines what each step leaves behind.

The chain starts with initial access, where a device-code phishing login or a reused refresh token gives a foothold. It moves through reconnaissance of users, groups, applications and open mailboxes, then persistence through a malicious application that a user is tricked into consenting to, followed by collection from mail, SharePoint and OneDrive and a cleanup stage. For each step, the talk compares interactive and non-interactive sign-in logs, Graph activity logs, audit logs and Office 365 mailbox events, and notes where failed attempts or token refreshes stay invisible unless specific settings are enabled.

Practitioners should turn on Entra ID sign-in and audit logging, and collect non-interactive sign-ins and Graph activity, then tune out polling noise and legitimate Microsoft traffic. Restricting users' ability to create apps and groups shrinks the default attack surface, and teams should practice revoking refresh tokens with current Microsoft Graph PowerShell tooling before they need it. Example detection rules were prototyped in YARA-L as a starting point for hunting.