Data Access Paths & Blast Radius Calculation

DFIR Investigation Charter

The Definitive Accounting of Breach Impact: During security incidents, technical stakeholders, executive leadership, legal counsel, and data privacy regulators converge on a single critical question: “What data was actually compromised?” Simply reporting that an account was accessed is legally and commercially catastrophic. This reference card provides the authoritative framework to map the 5 Data Access Paths, calculate the objective blast radius, and produce a defensible regulatory disclosure manifest under GDPR, SEC, and NIS2 guidelines.

1. The 5 Core Data Access Paths in Microsoft 365

Adversaries interact with corporate data through five distinct architectural modalities, each characterized by specific authentication mechanisms, protocol fingerprints, and logging granularity.

graph TD
    Attacker[Threat Actor / Compromised Identity] --> P1[Path 1: Interactive Web / Mobile Session]
    Attacker --> P2[Path 2: Native Sync Client Engines]
    Attacker --> P3[Path 3: Delegated OAuth Application Tokens]
    Attacker --> P4[Path 4: Application-Only Service Principals]
    Attacker --> P5[Path 5: Purview eDiscovery Super-Privilege]

    P1 -->|OWA, SPO Portal, Teams Web| Log1["Purview UAL: FileAccessed, MailItemsAccessed (Bind)"]
    P2 -->|OneDrive.exe, Outlook OST Sync| Log2["Purview UAL: FileSyncDownloadedFull, MailItemsAccessed (Sync)"]
    P3 -->|Graph API with User Context| Log3["Purview UAL + Sign-in Logs (User Impersonation)"]
    P4 -->|Graph API / App Secret / Cert| Log4["ServicePrincipalSignInLogs + UAL Workload Activity"]
    P5 -->|ComplianceSearchAction| Log5["Purview Audit: SearchExported, SearchCreated"]

Forensic Comparison of the 5 Access Paths

Access Path	Typical Threat Actor Technique	Protocol & Application ID	Key Telemetry Source	Forensic Visibility & Precision
1. Interactive Web	Stolen session cookie / AiTM proxy	HTTPS / Browser (UserAgent)	UAL (FileAccessed, Search)	Granular: identifies individual document views and searches
2. Native Sync Client	Machine registration / unmanaged sync	Cobalt / MAPI-HTTP (onedrive.exe)	UAL (FileSyncDownloadedFull)	Definitive: confirms complete binary file replication
3. Delegated App Token	Illicit OAuth app grant / Device Code	REST Graph API (Delegated scopes)	Sign-in Logs + UAL API logs	Tracks specific API calls executed under user identity
4. App-Only Principal	Injected certificate / client secret	REST Graph API (Files.Read.All)	ServicePrincipalSignInLogs + UAL	Highly opaque: tenant-wide access without user attribution
5. eDiscovery Export	Compromised eDiscovery Administrator	Purview Compliance Portal	UAL (SearchExported, SearchCreated)	Catastrophic: bulk PST / zip export of millions of items

---

2. Constructing the Evidence Matrix: Accessible vs Exfiltrated

Regulatory disclosures (e.g., GDPR Article 33/34 notifications, SEC 8-K filings) require a rigorous evidentiary threshold separating theoretical exposure from proven exfiltration:

flowchart TD
    AllData["Tenant Data Repository (Total Corpus)"] --> Accessible["1. Accessible Scope<br/>(All data the compromised identity had permissions to view)"]
    Accessible --> Queried["2. Discovered Scope<br/>(Specific search queries executed: SearchQueryPerformed)"]
    Queried --> Accessed["3. Observed Scope<br/>(Specific items viewed or bound: MailItemsAccessed, FileAccessed)"]
    Accessed --> Exfiltrated["4. Proven Exfiltration Scope<br/>(Items physically transferred: FileDownloaded, FileSyncDownloadedFull)"]

    style AllData fill:#f5f5f5,stroke:#999
    style Accessible fill:#fff3cd,stroke:#ffeeba
    style Queried fill:#d1ecf1,stroke:#bee5eb
    style Accessed fill:#d4edda,stroke:#c3e6cb
    style Exfiltrated fill:#f8d7da,stroke:#f5c6cb

The 4 Assessment Horizons

1. The Accessible Horizon (Permissive Blast Radius):
   • Every email in the victim’s mailbox, all files in their OneDrive, and all documents in SharePoint sites where the user had Read or Member permissions.
   • Legal Context: Represents worst-case theoretical exposure. Do not report as “exfiltrated” without supporting telemetry.
2. The Discovered Horizon (Search Intent):
   • Documents and emails returned in response to attacker-initiated searches (SearchQueryPerformed).
   • Proves attacker interest and tactical intent.
3. The Observed Horizon (Active Exposure):
   • Files rendered via Office Online (FileAccessed with WOPI properties) and individual emails opened in OWA (MailItemsAccessed with OperationType: Bind).
   • Proves the attacker reviewed the content, but does not confirm local disk saving.
4. The Proven Exfiltration Horizon (Definitive Compromise):
   • Explicit binary transfers: FileDownloaded, FileSyncDownloadedFull, outbound Message Trace delivery, and external anonymous sharing links accessed by third-party IPs.
   • Requires immediate regulatory notification if personal, health, or financial data is involved.

---

3. The Blast Radius Calculation Formula

To calculate the definitive compromise footprint, investigators apply a structured triage formula across the compromise window (T_start to T_end):

Blast Radius = M_exfil ∪ F_exfil ∪ S_anon ∪ C_throttled

Where:

• M_exfil: Emails with outbound Message Trace delivery or individual MailItemsAccessed (Bind) by attacker IPs.
• F_exfil: Files with FileDownloaded or FileSyncDownloadedFull attributed to attacker sessions.
• S_anon: All files residing in folders where the attacker created AnonymousLinkCreated tokens that were subsequently utilized.
• C_throttled: The entire item population of any mailbox folder where MailItemsAccessed recorded IsThrottled: True.

---

4. Detection Engineering: Comprehensive Blast Radius Query

KQL: Unified Exfiltration Synthesis

// Synthesize all file and email exfiltration events across workloads for a compromised session
let CompromiseStart = datetime(2026-09-01T00:00:00Z);
let CompromiseEnd = datetime(2026-09-17T23:59:59Z);
let SuspectUser = "victim@contoso.com";
let KnownAttackerIPs = dynamic(["198.51.100.45", "203.0.113.88"]);
CloudAppEvents
| where TimeGenerated between (CompromiseStart .. CompromiseEnd)
| where AccountDisplayName =~ SuspectUser or RawEventData.UserId =~ SuspectUser
| where IPAddress in (KnownAttackerIPs) or RawEventData.ClientIP in (KnownAttackerIPs)
| extend Workload = tostring(RawEventData.Workload)
| extend Operation = tostring(RawEventData.Operation)
| extend ObjectName = coalesce(tostring(RawEventData.SourceFileName), tostring(RawEventData.Item), tostring(RawEventData.ObjectId))
| extend TargetPath = tostring(RawEventData.SourceRelativeUrl)
| summarize
    EventCount = count(),
    FirstSeen = min(TimeGenerated),
    LastSeen = max(TimeGenerated)
    by Workload, Operation, ObjectName, TargetPath, IPAddress
| sort by Workload asc, Operation asc

KQL: Reconstructing eDiscovery Abuse

// Detect unauthorized eDiscovery searches and mass data exports
CloudAppEvents
| where TimeGenerated >= ago(30d)
| where ActionType in ("SearchCreated", "SearchExported", "SearchPreviewed")
| extend SearchName = tostring(RawEventData.SearchName)
| extend ExportLocations = tostring(RawEventData.Locations)
| project TimeGenerated, AccountDisplayName, ActionType, SearchName, ExportLocations, IPAddress, RawEventData
| sort by TimeGenerated desc

PowerShell: Automated Blast Radius Export

<#
.SYNOPSIS
    Compiles an authoritative exfiltration report across Purview UAL for a compromised account.
#>
Connect-ExchangeOnline

$User = "victim@contoso.com"
$AttackerIPs = @("198.51.100.45", "203.0.113.88")
$StartDate = (Get-Date "2026-09-01")
$EndDate = (Get-Date "2026-09-17")

Write-Host "[+] Extracting Proven Exfiltration Events for $User..." -ForegroundColor Cyan

$ExfilOps = @("FileDownloaded", "FileSyncDownloadedFull", "MailItemsAccessed", "Send", "SendAs")
$Results = Search-UnifiedAuditLog -Operations $ExfilOps -FreeText $User -StartDate $StartDate -EndDate $EndDate -ResultSize 5000

$Filtered = $Results | Where-Object {
    $Payload = $_.AuditData | ConvertFrom-Json
    $AttackerIPs -contains $Payload.ClientIP
}

Write-Host "[!] Identified $($Filtered.Count) proven data access events from attacker IPs!" -ForegroundColor Red
$Filtered | Select-Object CreationDate, Operations, @{N='ClientIP';E={($_.AuditData | ConvertFrom-Json).ClientIP}}, @{N='Object';E={($_.AuditData | ConvertFrom-Json).SourceFileName}} | Export-Csv -Path "BlastRadius_Report.csv" -NoTypeInformation

---

5. Defensible Regulatory Reporting Framework

When presenting incident findings to legal counsel, board members, and data protection authorities (e.g., CNIL, ICO, SEC, HHS):

1. Never Report Accessible as Compromised: Explicitly articulate the difference between the Accessible Corpus (10,000 files in accessible SharePoint libraries) and the Observed/Exfiltrated Corpus (14 files with FileDownloaded records).

2. Acknowledge Audit Gaps Honestly: If an Exchange mailbox folder recorded IsThrottled: True, clearly declare:

   “Due to platform audit throttling under Purview logging architecture, Exchange Online does not log individual item IDs during bulk sync operations exceeding 1,000 items. Consequently, while 14 items were definitively observed, the entire 850 items residing in the ‘Inbox’ must be legally treated as potentially exposed.”

3. Provide Cryptographic & Telemetry References: Anchor every exfiltrated document record with its tenant URL, exact byte size, file hash (if available from eDiscovery snapshot), client IP address, and RFC 3339 UTC timestamp.

---

6. Related Intelligence & Workload Guides

32. Microsoft 365 Data Attack Surface Mapping Foundational data topography, exposure vectors, and the evidentiary ladder.

33. Exchange Online Investigation Playbook Analyze MailItemsAccessed throttling and Message Trace delivery records.

34. SharePoint Online Forensics Investigate document preview vs download logs and anonymous sharing links.

35. OneDrive Forensics & Sync Exfiltration Understand FileSyncDownloadedFull telemetry and endpoint ODL logs.