My Cloud is APT's Cloud: Investigating and Defending Office 365

## Overview In the conference talk *"My Cloud is APT's Cloud: Attacking and Defending Office 365,"* Mandiant Incident Response Managers Doug Bienstock and Josh Madeley detail how targeted threat groups exploit, maintain persistence in, and exfiltrate data from Office 365 (O365) environments. The presentation stresses that O365 is not merely an email service, but a full authentication and collaboration ecosystem (including Exchange Online, Azure AD, Microsoft Teams, SharePoint Online, and Word Online) accessible globally without a VPN by default. Because perimeter security gives way to identity and metadata controls in the cloud, advanced adversaries invest heavily in targeting authentication workflows, legacy protocols, and administrative tooling.

---

## Authentication Architectures and Threat Surfaces O365 environments generally rely on one of two hybrid identity models: - **Managed Authentication:** Azure Active Directory (Azure AD) manages authentication directly using Password Hash Synchronization (PHS)—Microsoft's preferred method enabling features like Azure AD Identity Protection—or Pass-Through Authentication (PTA) via on-premises software agents. - **Federated Authentication:** Authentication is handed off to third-party Identity Providers (IdPs) such as Active Directory Federation Services (ADFS), Okta, or Ping Identity. ADFS proxies in network DMZs validate credentials against on-premises AD and issue signed SAML assertion tokens to the cloud.

Authentication protocols are bifurcated into: 1. **Modern Authentication:** Based on OAuth, modern authentication supports Multi-Factor Authentication (MFA) and Conditional Access policies that evaluate contextual metadata (e.g., location, device health). 2. **Legacy Authentication:** Utilized by older protocols and services (POP, IMAP, older PowerShell versions, AutoDiscover). It relies on HTTP Basic Authentication, inherently lacks MFA support, and remains enabled by default, making it a frequent target for credential stuffing and password spraying.

---

## Logging, Visibility, and Forensic Challenges Defenders rely on three primary logging sources, each presenting distinct operational limitations: - **Unified Audit Log (UAL):** Aggregates cross-application actions (timestamp, username, operation, client IP, parameters) and retains data for 90 days by default (extendable with E5 licenses). However, native search interfaces are constrained, necessitating forwarding to a SIEM. - **Mailbox Audit Logs:** Track mailbox actions by owners, delegates, and administrators (e.g., logons, folder binds, message binds, `MailItemsAccessed`). Crucially, without advanced auditing licenses, defender visibility is severely limited: if an adversary logs in with valid credentials, their specific interactions with mail items are not recorded. Furthermore, logs are stored within individual mailboxes rather than centrally indexed, requiring per-mailbox PowerShell queries if not pre-aggregated. - **Azure AD and Admin Audit Logs:** Admin logs track administrative cmdlets, while Azure AD audit logs (available to E5 subscribers for 30 days) capture deeper authentication metadata such as specific MFA types and client applications. Additional visibility is supported by Mail Flow (Mail Trace) logs and Security & Compliance Center search reports.

---

## Case Studies: Initial Access and MFA Bypasses The speakers highlight real-world incident response investigations where adversaries compromised accounts despite Conditional Access policies enforcing MFA:

- **Azure AD PowerShell Module Bypass:** In one engagement following a Citrix NetScaler compromise, attackers harvested credentials for an on-premises LDAP connector account synced to Azure AD. Any tenant user (even unlicensed) can authenticate via the `AzureAD` PowerShell module, which could not be administratively disabled. At the time of the breach, this module completely bypassed Conditional Access evaluation, allowing the adversary to connect directly, enumerate roughly 50,000 users, and launch an extensive internal password spray. (Microsoft has since patched this bypass without explicit release notes). - **Legacy Sign-in Assistant and Partner Portal Bypass:** Attackers leveraged the legacy Microsoft Online Services Sign-in Assistant (`msoidsvc.exe`) alongside a 2016-era version of the Exchange Online PowerShell module (identified in logs as the Microsoft Online Syndication Partner Portal, or `MOSPP`). This legacy tooling combination completely circumvented Conditional Access policies enforcing MFA before Microsoft addressed the loophole. - **OAuth Application Abuse:** Adversaries target legitimate Microsoft identity frameworks by enticing users to grant permissions to malicious third-party OAuth apps. Once consented to, these integrations bypass MFA prompts entirely to access user data directly.