Microsoft 365 playbooks #

Playbooks for Microsoft 365 and Entra ID incidents. Expand a playbook for step-by-step actions; adapt the order to the environment and the rules of engagement, and record each step in your notes as you go. All playbooks.

Playbook - suspected BEC in M365
  1. Money first: if a payment went out, the client calls their bank now to request a recall, and files with the FBI IC3 (the Recovery Asset Team works best within about 72 hours). Everything else can run in parallel.
  2. Preserve: confirm the unified audit log is ingesting (Get-AdminAuditLogConfig | fl UnifiedAuditLogIngestionEnabled, on by default) and export the incident window before it ages out (180 days on Audit Standard); put a Purview eDiscovery hold or retention hold on the involved mailboxes and OneDrive.
  3. Scope the mailbox: pull the UAL for the user - UserLoggedIn, MailItemsAccessed, Send / SendAs / SendOnBehalf, inbox-rule changes (New-InboxRule, Set-InboxRule, UpdateInboxRules from Outlook clients), Consent to application - and pivot on SessionId, ClientIP and user agent. See M365 for what MailItemsAccessed can and can't show.
  4. Entra sign-ins: interactive and non-interactive logs. AiTM markers: one session ID used from two IPs, a sign-in from an unfamiliar ASN or hosting provider right after the user's own, and MFA shown as satisfied by claim in the token - a stolen session usually looks like a successful MFA sign-in, not a missing one.
  5. Rules and forwarding (read-only checks): Get-InboxRule -Mailbox <user> -IncludeHidden (hidden rules are a BEC favourite); Get-Mailbox <user> | fl ForwardingSmtpAddress,ForwardingAddress,DeliverToMailboxAndForward; Get-TransportRule for tenant-wide redirects. Typical attacker rules move or delete mail containing "invoice", "payment" or the target's name.
  6. Persistence: MFA methods registered in the window (Entra audit log: User registered security info), OAuth apps consented, service principal credentials added, mailbox delegates / FullAccess / SendAs permissions granted.
  7. Downstream: what did the attacker send - invoice or bank-detail changes, phishing to partners, replies to look-alike domains? Message trace (Get-MessageTraceV2: 90 days, 10-day windows per query) and the user's Sent Items / Deleted Items. Notify affected partners.
  8. Contain: revoke sessions (Revoke-MgUserSignInSession), reset the password, remove attacker MFA methods, rules, forwarding, delegates and app consents; block legacy authentication; require phishing-resistant MFA for the user and admins. A password reset alone does not end existing sessions.
  9. Report with ATT&CK (T1566.002, T1557, T1078.004, T1114.003, T1564.008, T1534, T1098.001, T1098.005), impact assessment and remediation roadmap.
Procedure - preserving M365 evidence for litigation

Purview eDiscovery Premium - create a case, apply a legal hold on relevant custodians (mailbox + OneDrive + Teams), run searches to identify responsive items, export to a verified PST/MSG with manifest + hash. Document everything in the custody log. Combine with UAL export for the audit trail. For Entra sign-ins, export via Graph to immutable storage. If broader scope needed, Microsoft can produce server-side logs via support case under a data preservation request from counsel.