Microsoft 365 Account Compromise Kill Chain

In modern enterprise cyber intrusions, the compromise of a cloud identity is rarely an isolated security event. Rather, it represents the foundational pivot of an orchestrated, multi-stage cloud intrusion sequence. The Microsoft 365 Account Compromise Kill Chain adapts classical military and cyber kill chain models to the nuances of the Microsoft Entra ID identity plane, SaaS workloads (Exchange Online, SharePoint, Teams), and OAuth 2.0 / OpenID Connect token mechanics.

Incident response teams frequently fail to contain cloud compromises because they treat account takeovers (ATO) as single-point remediations—resetting the victim’s password while leaving malicious OAuth apps, backdoor MFA methods, hidden mailbox forwarding rules, and persistent session tokens untouched.

This guide details the complete 7-stage M365 Account Compromise Kill Chain, mapping the technical mechanics, adversary techniques, forensic artifacts, and evidentiary requirements at each phase.

1. The 7-Stage M365 Account Compromise Architecture

Unlike on-premises Active Directory intrusions where adversaries navigate Kerberos tickets, NTLM hashes, and RPC endpoints, Microsoft 365 intrusions operate almost entirely over HTTPS (REST APIs, MS Graph, OData, SOAP) and JSON Web Tokens (JWT):

graph TD
    subgraph "Phase 1: Reconnaissance"
        P1_RECON[Target Enumeration & Tenant Discovery<br/>GetCredentialType API, OpenID Config, MX/SPF Scrape]
    end

    subgraph "Phase 2: Initial Ingress"
        P2_INGRESS[Initial Access Vector Execution<br/>AiTM Phishing, Device Code Flow, Consent Phish, Password Spray]
    end

    subgraph "Phase 3: Authentication & Token Acquisition"
        P3_AUTH[MFA Bypass & Session Capture<br/>ESTSAUTH Cookie Theft, PRT Abuse, Push Fatigue]
    end

    subgraph "Phase 4: Persistence & Backdooring"
        P4_PERSIST[Secondary Credential & Mechanism Injection<br/>MFA Device Registration, Illicit OAuth Apps, Mailbox Forwarding]
    end

    subgraph "Phase 5: Internal Discovery"
        P5_DISC[Cloud Tenant Reconnaissance<br/>MS Graph Enumeration, GAL Scraping, SharePoint Search]
    end

    subgraph "Phase 6: Lateral Movement & Privilege Escalation"
        P6_LATERAL[Internal Phishing, PIM Abuse & Role Hijacking<br/>App Role Assignments, Group Manipulation, Tier Crossing]
    end

    subgraph "Phase 7: Exfiltration & Objective Execution"
        P7_IMPACT[Financial Fraud & Confidential Data Exfiltration<br/>BEC Wire Redirect, Bulk Mailbox Sync, SharePoint Mass Download]
    end

    P1_RECON --> P2_INGRESS
    P2_INGRESS --> P3_AUTH
    P3_AUTH --> P4_PERSIST
    P4_PERSIST --> P5_DISC
    P5_DISC --> P6_LATERAL
    P6_LATERAL --> P7_IMPACT

2. Phase-by-Phase Technical & Forensic Breakdown

Phase 1: Reconnaissance & Target Enumeration

Adversaries passively and actively profile the target tenant before launching authentication attempts:

Technique	Architectural Mechanism	Forensic Artifact / Endpoint	Threat Actor Tooling
Tenant Discovery	Querying OpenID metadata to resolve Tenant ID and vanity domains.	`https://login.microsoftonline.com/<domain>/.well-known/openid-configuration`	AADInternals, curl, custom Python
User Enumeration	Probing the `GetCredentialType` API endpoint to verify valid UPNs without triggering lockout counters.	`POST https://login.microsoftonline.com/common/GetCredentialType` (`IfExistsResult`: 0 = Exists, 1 = Not Found)	AADInternals, SprayingToolkit
Federation Discovery	Identifying whether the tenant uses Managed Auth, Seamless SSO, or ADFS federation.	`Get-UserRealm.auth` endpoint returning `IsFederated: True/False`	BloodHound Azure, Roadtools

Phase 2: Initial Ingress

The threat actor interacts directly with the victim or the authentication boundary to obtain initial credentials or token grants:

graph TD
    VEC{Initial Ingress Vector}

    VEC -->|AiTM Reverse Proxy| AITM[Evilginx / Muraena<br/>Victim enters creds + MFA on fake domain]
    VEC -->|Device Code Flow| DCF[RFC 8628 Phishing<br/>Victim inputs user_code on devicelogin]
    VEC -->|OAuth Consent Phish| CONSENT[Malicious Multi-Tenant App<br/>Victim clicks Accept on permissions]
    VEC -->|Password Spray| SPRAY[Distributed Single-Password Tests<br/>Probing legacy auth or web endpoints]

AiTM Reverse Proxy: Attacker proxies victim traffic to genuine Microsoft login portals, intercepting credentials and session cookies in flight (see Fiche 21: Adversary-in-the-Middle Mechanics).
Device Code Flow Abuse: Attacker sends a phishing lure containing a user_code, prompting the user to authorize an Azure CLI or PowerShell application (see Fiche 25: Device Code Flow Abuse).
Illicit Consent Grant: Attacker tricks user into approving high-privilege application permissions (Mail.ReadWrite, offline_access) (see Fiche 23: Illicit Consent Grants).
Password Spraying: Low-and-slow authentication against cloud endpoints across hundreds of target users to evade Smart Lockout (see Fiche 24: Password Spray & Brute Force).

Phase 3: Authentication & Token Acquisition

Once initial credentials or session materials are acquired, the adversary completes authentication and obtains reusable tokens:

Session Cookie Replay:
- The stolen ESTSAUTH and ESTSAUTHPERSISTENT cookies are injected into the adversary’s browser or automated headless framework.
- The adversary accesses cloud resources from their own infrastructure, bypassing MFA because the session is already authenticated.
Primary Refresh Token (PRT) Abuse:
- On compromised Windows endpoints, malware uses the Cloud AP broker to request tokens silently for cloud apps without prompting the user.
MFA Push Fatigue (Bombing):
- Flooding the victim with repeated Microsoft Authenticator approval requests until the user accepts out of frustration or confusion.

Key Telemetry Signatures:

SigninLogs: Correlation of a successful sign-in (ResultType = 0) from a foreign IP/UserAgent immediately following an MFA challenge completed from the victim’s legitimate network.
Entra ID Protection Risk Events: Atypical travel, Unfamiliar sign-in properties, Anomalous token (see Fiche 12: Entra ID Protection Forensics).

Phase 4: Persistence & Backdooring

Adversaries understand that user passwords will eventually be rotated. They immediately establish independent, parallel persistence mechanisms:

graph TD
    ACCESS[Compromised Account Authenticated] --> P_MFA[Register Additional MFA Device<br/>FIDO2 Key, Phone Number, MS Authenticator]
    ACCESS --> P_APP[Authorize Multi-Tenant OAuth App<br/>offline_access -> Permanent Graph API Token]
    ACCESS --> P_RULE[Inject Mailbox Forwarding / Inbox Rules<br/>Redirect financial emails to attacker domain]
    ACCESS --> P_DEL[Grant Mailbox Delegate Permissions<br/>FullAccess or SendAs to external/guest account]

Forensic Artifacts Generated:

Entra Audit Logs (AuditLogs):
- User registered security info (New phone number or Authenticator app added).
- Add service principal / Consent to application (OAuth application authorization).
Purview Unified Audit Log (ExchangeItem / AzureActiveDirectory):
- New-InboxRule / Set-InboxRule (Hidden rules forwarding or deleting messages).
- Add-MailboxPermission (Granting delegate rights).

Phase 5: Internal Discovery

With persistence secured, the threat actor maps tenant architecture, identifies high-value targets, and searches for sensitive business documents:

Microsoft Graph Directory Reconnaissance:
- Enumerating all tenant users, administrative roles, and security groups (GET /v1.0/users, GET /v1.0/directoryRoles).
Global Address List (GAL) Scraping:
- Identifying organizational hierarchy, C-suite executives, finance controllers, and accounts payable staff.
SharePoint & OneDrive Keyword Hunting:
- Querying Purview search indexes for high-value terms: "wire transfer", "banking", "invoice", "confidential", "passwords", "acquisition".
- On Audit Premium tenants, this triggers SearchQueryInitiatedSharePoint and SearchQueryInitiatedExchange in the UAL.

Phase 6: Lateral Movement & Privilege Escalation

Adversaries leverage the compromised account to pivot deeper into the environment:

Internal Phishing (BEC Intra-Tenant):
- Sending phishing emails to colleagues from the compromised internal mailbox. Because internal mail bypasses many external anti-spam filters and carries intrinsic trust, click-through rates exceed 60%.
Privileged Identity Management (PIM) Abuse:
- If the compromised identity is eligible for an administrative role (e.g., Exchange Admin, User Admin), the attacker activates the role via POST /v1.0/privilegedAccess/aadRoles/roleAssignmentRequests.
Teams & SharePoint File Poisoning:
- Uploading trojanized documents or reverse-shell payloads to shared Teams channels.

Phase 7: Exfiltration & Objective Execution

The ultimate phase of the kill chain delivers the attacker’s primary objectives:

graph TD
    OBJ{Adversary Objective}

    OBJ -->|Financial Wire Fraud| BEC[Business Email Compromise<br/>1. Monitor invoices via Inbox Rules<br/>2. Intercept vendor communication<br/>3. SendAs modified bank routing details]

    OBJ -->|Corporate Espionage| EXFIL[Data Exfiltration<br/>1. Bulk Mailbox Sync via Graph API<br/>2. Mass download from SharePoint/OneDrive<br/>3. Teams chat history dump]

    OBJ -->|Ransomware Extortion| EXTORT[Extortion & Destruction<br/>1. Exfiltrate sensitive PII/IP<br/>2. Purge mailbox contents (HardDelete)<br/>3. Threaten public leak]

Business Email Compromise (BEC): Altering banking details during active wire transfer negotiations using SendAs or SendOnBehalf (see Fiche 17: Mailbox Auditing).
Bulk Mailbox Exfiltration: Using ActiveSync or Graph API delta syncs to download the entire mailbox history, generating MailItemsAccessed (Sync) events.
Mass Document Theft: Automated mass downloading of OneDrive and SharePoint document libraries, generating thousands of FileDownloaded records (RecordType 6) in the UAL.

3. Evidentiary Progression Matrix for Incident Responders

During an investigation, technical findings must progress through rigorous evidentiary thresholds before being asserted in final reports:

Threshold	Technical Definition	Example Forensic Scenario
Possible	An architecture allows the technique in theory.	The tenant has IMAP enabled on user mailboxes.
Configured	Settings or policies are actively in place to allow it.	Conditional Access does not block legacy authentication protocols.
Authorized	The account possesses the necessary license and privileges.	The compromised account has an Exchange Online Plan 2 license assigned.
Accessible	Network path and authentication boundaries were reachable.	EOP accepted an incoming connection on port 25 from the adversary IP.
Utilized	Adversary actively invoked the mechanism.	`SigninLogs` shows `ClientAppUsed = IMAP4` with `ResultType = 0`.
Observed	Specific actions and operations generated audit records.	`CloudAppEvents` logs `MailItemsAccessed (Sync)` for `\Inbox`.
Proven	Irrefutable end-to-end telemetry confirms data impact.	Resolved message IDs match exfiltrated wire transfer invoices with exact hashes.

4. Master Remediation & Tenant Containment Protocol

When severing an adversary’s kill chain, responders must execute remediation in strict topological order to prevent reinfection:

graph TD
    STEP1[1. Revoke All User Sessions & Refresh Tokens<br/>Revoke-MgUserSignSession] --> STEP2[2. Reset Account Password<br/>Invalidate legacy credential hashes]
    STEP2 --> STEP3[3. Audit & Purge MFA Registrations<br/>Remove unknown phone numbers, tokens, FIDO keys]
    STEP3 --> STEP4[4. Revoke Illicit OAuth Apps & Permissions<br/>Remove-MgOauth2PermissionGrant]
    STEP4 --> STEP5[5. Remove Malicious Mailbox Rules & Delegates<br/>Remove-InboxRule, Remove-MailboxPermission]
    STEP5 --> STEP6[6. Terminate Active PIM Activations<br/>Revoke elevated admin privileges]

PowerShell Emergency Containment Script:

# Connect with Required Scopes
# Connect-MgGraph -Scopes "User.ReadWrite.All","Directory.AccessAsUser.All"
# Connect-ExchangeOnline

$targetUser = "victim@target.com"
Write-Host "[*] Executing Emergency Containment for: $targetUser" -ForegroundColor Yellow

# Step 1: Revoke all active refresh tokens and sessions
Revoke-MgUserSignSession -UserId $targetUser
Write-Host "[+] All active Entra ID sessions revoked." -ForegroundColor Green

# Step 2: Audit and list registered MFA authentication methods
$mfaMethods = Get-MgUserAuthenticationMethod -UserId $targetUser
Write-Host "[!] Review registered MFA methods carefully:" -ForegroundColor Cyan
$mfaMethods | Select-Object Id, AdditionalProperties

# Step 3: Remove malicious Inbox Rules
$inboxRules = Get-InboxRule -Mailbox $targetUser
foreach ($rule in $inboxRules) {
    if ($rule.ForwardTo -or $rule.RedirectTo -or $rule.DeleteMessage) {
        Write-Warning "[!] Suspicious Inbox Rule detected: $($rule.Name) -> Forward: $($rule.ForwardTo) Delete: $($rule.DeleteMessage)"
        # Remove-InboxRule -Mailbox $targetUser -Identity $rule.Identity -Confirm:$false
    }
}

# Step 4: Audit OAuth Consent Grants for the User
$userGrants = Get-MgOauth2PermissionGrant -Filter "principalId eq '$((Get-MgUser -UserId $targetUser).Id)'"
Write-Host "[*] User OAuth permission grants found: $($userGrants.Count)" -ForegroundColor Cyan
$userGrants | Select-Object ClientId, ResourceId, Scope