Reconstructing a Microsoft 365 Attack Timeline

Corpus Roadmap — Planned Publication

This dossier is part of the Hermes Codex Microsoft 365 DFIR corpus (Bloc IX — DFIR Methodology). Detailed forensic analysis, detection rules, and field investigation procedures for this topic are integrated with the foundational architecture established in Phase 1.

Overview & Investigation Context

This reference card details the technical mechanics, log artifacts, and forensic methodology for Reconstructing a Microsoft 365 Attack Timeline.

During Microsoft 365 incident response engagements, investigators must navigate the identity plane, workload activity records, and cloud telemetry while maintaining strict adherence to the evidentiary threshold:

Possible → Configured → Authorized → Accessible → Utilized → Observed → Proven

---

Key Cross-References & Prerequisites

01. M365 DFIR Fundamentals Understand the core tenant architecture, identity boundaries, and workload interactions.

02. Microsoft Entra ID: The Identity Plane Explore user, group, device, and service principal authentication pipelines.

04. Preparing a Tenant for DFIR CSIRT onboarding protocol, credential sanitization, and emergency tenant access.

06. M365 DFIR Access Matrix Operational role, license, portal, and log retention lookup table.