Microsoft 365 Data Attack Surface Mapping

DFIR Investigation Charter

Workload-Centric Data Forensics: While identity compromise occurs at the Entra ID plane, the true objective of threat actors in business email compromise (BEC), ransomware staging, and state-sponsored espionage is data access, exfiltration, and manipulation. This dossier establishes the systemic framework for mapping, inventorying, and constraining data attack surfaces across Exchange Online, SharePoint Online, OneDrive for Business, Microsoft Teams, and cross-tenant federation boundaries.

1. Multi-Workload Data Topography

Modern Microsoft 365 tenants represent distributed, polyglot data repositories. An adversary who establishes a foothold (via session hijacking, illicit OAuth consent, or service principal credentials) can traverse distinct operational workloads, each possessing unique storage abstractions, access protocols, and auditing fidelity.

graph TD
    subgraph IdentityPlane ["Microsoft Entra ID (Identity Plane)"]
        Token[OAuth 2.0 Access Token / PRT]
        AppToken[Application-Only Service Principal Token]
    end

    subgraph DataPlane ["Microsoft 365 Data Fabric"]
        EXO["Exchange Online<br/>(User Mailboxes, Shared Mailboxes, Archive)"]
        SPO["SharePoint Online<br/>(Team Sites, Communication Sites, Hubs)"]
        ODB["OneDrive for Business<br/>(Personal Drives, Sync Endpoints)"]
        Teams["Microsoft Teams<br/>(Substrate Chats, Group Mailboxes, Channel Files)"]
        Fabric["Power Platform & Fabric<br/>(Power BI Datasets, Dataverse)"]
    end

    subgraph SearchDiscovery ["Tenant-Wide Discovery Engines"]
        MSearch["Microsoft Search / Graph API /search"]
        Delve["Office Graph & Semantic Discoverability"]
        eDisc["Purview eDiscovery (Super-User Access)"]
    end

    Token --> EXO
    Token --> SPO
    Token --> ODB
    Token --> Teams
    AppToken --> EXO
    AppToken --> SPO
    AppToken --> Fabric

    Token --> MSearch
    MSearch -.-> SPO
    MSearch -.-> ODB
    MSearch -.-> EXO
    MSearch -.-> Teams

Data Repository Characteristics & Forensics Matrix

Workload	Storage Architecture	Protocols & Client Access	Primary Audit Stream	Default Exposure Risk
Exchange Online	ESE Database Partition (Azure Substrate)	MAPI-HTTP, EWS, ActiveSync, REST Graph	Purview UAL (ExchangeItem)	Inbox rules, forwarders, delegated permissions
SharePoint Online	Azure SQL + Azure Blob Storage	REST, CSOM, SOAP, WebDAV, Browser UI	Purview UAL (SharePointFileOperation)	“Anyone” sharing links, broad site permissions
OneDrive for Business	Personal SharePoint Site Collection (/personal/)	Sync Client (ODL), REST Graph, Browser UI	Purview UAL (OneDrive)	Sync exfiltration, external guest links
Microsoft Teams	Hybrid Substrate (Exchange + SPO + ODB)	Skypetoken, MTnp, REST Graph	Purview UAL (MicrosoftTeams)	External federation, guest accounts in channels
Power Platform / Fabric	Dataverse / Azure Data Lake Storage Gen2	OData, TDS, Power Apps Client	Purview UAL (PowerPlatform)	Automated cross-tenant flows, data connector leakage

---

2. Exposure Vectors & Lateral Data Movement

Adversaries do not merely download files; they exploit built-in collaboration features to discover, aggregate, and stage sensitive corporate intellectual property.

flowchart LR
    A[Initial Foothold] --> B[Tenant Discovery]
    B --> C{Exposure Mechanism}
    C -->|Graph Search| D[Bulk Keyword Search: 'password', 'invoice', 'merger']
    C -->|Sharing Links| E[Harvest 'Anyone with the link' Anonymous Tokens]
    C -->|Teams Federation| F[Exfiltrate Files via External 1:1 Chat]
    C -->|OAuth Apps| G[Backdoor Global Read Permissions]
    D --> H[Staged Exfiltration]
    E --> H
    F --> H
    G --> H

1. Tenant-Wide Search Discovery (/search/query)

An attacker possessing low-privileged user tokens can execute unified Microsoft Graph search queries (https://graph.microsoft.com/v1.0/search/query). Microsoft Search indexes documents, emails, chat messages, and SharePoint lists across the entire tenant that have been overshared (e.g., shared with “Everyone except external users”).

• Forensic Artifact: SearchQueryPerformed in Purview UAL.
• Hunting Indicator: Rapid succession of broad lexical queries targeting financial terms (salary, budget, wire), credentials (passwords, keys, config), or legal documentation.

2. Sharing Link Permutations

SharePoint and OneDrive support four distinct permission tiers for sharing links:

• Anonymous (“Anyone with the link” - AnonymousLinkCreated): Creates a tokenized URL accessible by anyone on the public Internet without authentication. Adversaries generate these links to exfiltrate files without triggering sign-in anomalies.
• Company (“People in your organization” - CompanyLinkCreated): Exposes documents to all internal tenant identities, dramatically broadening lateral data exposure.
• Specific People (SecureLinkCreated): Restricts access to named internal or external users.
• Direct Permissions (AddedToSecureLink): Grants explicit ACL-level rights to specific identities.

3. Cross-Tenant Synchronization & External Access

• B2B Direct Connect (Teams Shared Channels): Allows users from external tenants to access shared channels without switching directories, enabling stealthy data harvesting.
• Tenant Restriction Bypasses: Attackers use the compromised corporate workstation to upload data to an external, attacker-controlled Microsoft 365 tenant if outbound tenant restrictions are not enforced at the proxy/firewall level.

---

3. The Evidentiary Threshold Ladder

In data breach investigations, corporate counsel, cyber insurance underwriters, and regulatory authorities (GDPR, SEC, HIPAA) require defensible proof distinguishing between potential exposure and actual exfiltration.

The Hermes Codex Evidentiary Ladder provides a formal framework to classify attacker data interactions:

graph TD
    L1["1. Possible<br/>Data resides in tenant where account was compromised"] --> L2["2. Configured<br/>Workload, license, and sharing policies permitted access"]
    L2 --> L3["3. Authorized<br/>Account had explicit or inherited ACL/RBAC permissions"]
    L3 --> L4["4. Accessible<br/>No Conditional Access, device block, or network block prevented access"]
    L4 --> L5["5. Utilized<br/>Account authenticated to the workload during compromise window"]
    L5 --> L6["6. Observed<br/>Specific audit log record indicates search, view, or touch"]
    L6 --> L7["7. Proven<br/>Cryptographic or telemetry record confirms transmission/exfiltration"]

    style L1 fill:#f9f9f9,stroke:#999
    style L2 fill:#f0f0f0,stroke:#888
    style L3 fill:#e0e0e0,stroke:#777
    style L4 fill:#d0d0d0,stroke:#666
    style L5 fill:#b0e0e6,stroke:#008b8b
    style L6 fill:#98fb98,stroke:#2e8b57
    style L7 fill:#32cd32,stroke:#006400,color:#fff

Evidentiary Tiers & Legal Reporting Standards

1. Possible (Tier 1): The user account has an active mailbox or access to a SharePoint site, but no evidence shows the attacker reached the workload.
2. Configured & Authorized (Tiers 2-3): Effective permissions allow access, but no authentication occurred.
3. Accessible & Utilized (Tiers 4-5): Attacker tokens touched the workload endpoint (e.g., UserLoggedIn to Exchange Online), establishing an opportunity window.
4. Observed (Tier 6): An audit event (MailItemsAccessed, FileAccessed, SearchQueryPerformed) proves the attacker encountered specific data objects.
5. Proven (Tier 7): Unambiguous transmission records (FileDownloaded, FileSyncDownloadedFull, Message Trace outbound delivery) confirm data exfiltration beyond the enterprise boundary.

---

4. Detection Engineering: Cross-Workload Exposure Hunting

KQL: Tenant-Wide Search Spikes

// Detect anomalous search query bursts across workloads
CloudAppEvents
| where TimeGenerated >= ago(7d)
| where ActionType in ("SearchQueryPerformed", "Search")
| extend QueryText = tostring(RawEventData.QueryText)
| summarize
    QueryCount = count(),
    DistinctQueries = dcount(QueryText),
    Queries = make_set(QueryText, 20)
    by AccountObjectId, IPAddress, bin(TimeGenerated, 1h)
| where QueryCount > 30 or DistinctQueries > 15
| extend IsSensitiveKeyword = iff(Queries has_any ("password", "salary", "bonus", "confidential", "wire", "merger", "secret"), 1, 0)
| sort by IsSensitiveKeyword desc, QueryCount desc

KQL: Anonymous Sharing Link Creation

// Detect creation of anonymous "Anyone" links by compromised accounts
CloudAppEvents
| where TimeGenerated >= ago(14d)
| where ActionType in ("AnonymousLinkCreated", "SharingSet")
| extend TargetObject = tostring(RawEventData.ObjectId)
| extend EventSource = tostring(RawEventData.Workload)
| extend ClientIP = tostring(RawEventData.ClientIP)
| project TimeGenerated, AccountDisplayName, ActionType, EventSource, TargetObject, ClientIP
| sort by TimeGenerated desc

PowerShell: Broad SharePoint Permission Audit

<#
.SYNOPSIS
    Scans SharePoint Online sites for broad "Everyone" or "Anyone" permissions.
#>
Connect-SPOService -Url "https://contoso-admin.sharepoint.com"

$Sites = Get-SPOSite -Limit All
foreach ($Site in $Sites) {
    if ($Site.SharingCapability -ne "Disabled") {
        Write-Host "[!] Site $($Site.Url) allows sharing: $($Site.SharingCapability)" -ForegroundColor Yellow
    }
}

---

5. Blast Radius Containment Procedures

1. Revoke Active Sharing Links: Immediately revoke anonymous sharing links created during the compromise window:

   # Remove anonymous links on specific files via PnP PowerShell
   Get-PnPFileSharingLink -Identity "/sites/Finance/Shared Documents/Payroll.xlsx" | Where-Object {$_.LinkKind -eq "Anonymous"} | Remove-PnPFileSharingLink

2. Disable Outbound Tenant Access on Perimeter Proxies: Enforce HTTP headers on corporate outbound proxies to prevent exfiltration to rogue Microsoft 365 tenants:

   • Restrict-Access-To-Tenants: contoso.com, contoso.onmicrosoft.com
   • Restrict-Access-Context: 11111111-2222-3333-4444-555555555555

3. Purge Mailbox Search Caches & Offline Syncs: Force-clear offline caches and invalidate Outlook/OneDrive device sync pairings via Intune / Entra device wipe.

---

6. Related Intelligence & Workload Guides

33. Exchange Online Investigation Playbook Deep dive into mailbox forensics, MailItemsAccessed, and Message Trace correlation.

34. SharePoint Online Forensics Analyze file access logs, sharing permissions, and version history artifacts.

35. OneDrive Forensics & Sync Exfiltration Investigate personal drive exfiltration, sync client mechanics, and endpoint logs.

37. Data Access Paths & Blast Radius Calculate exact exfiltration exposure and construct defensible incident response reports.