After compromise, teams should look for unusual authentication patterns, unfamiliar devices, and activity that does not match the user’s normal behavior. In practice, that means checking where the account logged in from, what device it used, and what actions followed sign-in. Those signals help separate routine usage from attacker behavior and guide containment decisions quickly.
What to inspect first after a Microsoft 365 compromise
The first pass should reconstruct the session story, not just confirm that the password was changed. Review sign-in geography, device posture, time-of-day patterns, authentication method changes, token refresh activity, and any mailbox or file access that occurred immediately after the suspicious login. The point is to separate normal reuse from attacker-driven access and to establish whether the compromise is still active.
That investigation is most useful when it compares the current activity against a known baseline for the user or workload. A single unusual login may be benign, but an unfamiliar device plus a new access pattern plus post-login mailbox changes is materially different. When those signals cluster, containment should move from observation to interruption.
The 52 NHI Breaches Report is useful here because the compromise pattern often extends beyond a single account into credential misuse, lateral movement, and broader access abuse.
How attackers typically continue after initial access
Once inside, attackers usually try to preserve access, expand visibility, or create a second foothold. In Microsoft 365 environments that often means mailbox rules, forwarding changes, OAuth consent abuse, new inbox folders, shared link creation, or unusual access to documents and contacts. The concern is not only exfiltration, but also persistence through settings that keep yielding access after the original login event.
Watch for activity that changes the account’s control surface, such as alternate recovery details, delegated access, or newly authorized applications. Those actions can make the compromise harder to unwind because the attacker is no longer relying only on a stolen password or session. If the account has been used to send messages, inspect whether the compromise is also being used for phishing or business email compromise-style follow-on activity.
MITRE ATT&CK Enterprise Matrix helps map these follow-on behaviors to credential access, mailbox manipulation, persistence, and lateral movement patterns.
NIST SP 800-53 Rev 5 Security and Privacy Controls is a strong reference point for aligning review steps to audit, access control, and account integrity monitoring.
What good containment evidence looks like
Useful evidence is specific and time bound. Teams should be able to answer who authenticated, from where, with what device, what session or token was issued, and which actions followed in the same window. That evidence set is what allows responders to determine whether the account was briefly exposed, actively used, or fully taken over.
Good containment also means checking downstream objects touched by the account, not just the account itself. Mailbox items, shared files, delegated permissions, and connected applications can all carry the attacker’s effect forward even after the original login is blocked. If the review only stops at sign-in logs, you can miss the operational impact that matters most.
NIST Cybersecurity Framework 2.0 is helpful as a broad organiser for detect and respond activities once the compromise is suspected.
CIS Controls v8 provides a practical lens for reviewing account activity, logging, and access control failures that can follow account compromise.
Risk and Threat Considerations
An Office 365 compromise is risky because the attacker may not need to stay noisy. A valid sign-in, especially from a familiar tenant or cloud path, can look routine while the real abuse happens through token use, mailbox changes, forwarding, or document access. The most dangerous cases are those where the attacker blends in long enough to establish persistence or steal information before the alerting stack catches up.
Failure mechanism: Stolen credentials, session tokens, or delegated access let the attacker reuse legitimate control paths, which can hide malicious activity inside normal productivity traffic.
Impact: The account can be used for theft, fraud, phishing, internal reconnaissance, or broader compromise of connected users and shared content.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5, CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1078 — Valid Accounts | Compromised Office 365 accounts are reused through legitimate sign-in paths. |
| Recommendation — Map suspicious access to Valid Accounts and hunt for post-login abuse and persistence. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | Post-compromise triage depends on reviewing authentication and activity logs. |
| IA-5 — Authenticator Management | Compromise response often requires credential, token, and session reset. | |
| Recommendation — Review audit trails to correlate sign-ins, device use, and downstream actions. Reset and reissue authenticators and revoke active sessions after compromise. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | The question centers on the logs needed to detect attacker behavior after login. |
| Recommendation — Centralise and review authentication and mailbox logs for anomalous post-login activity. | ||
| NIST CSF 2.0 | DE.CM-03 — Detect Unauthorized Users, Connections, Devices, and Software | Unfamiliar devices and unusual authentication patterns are direct detection signals. |
| RS.AN-01 — Investigation is performed to ensure effective response and support forensics | Compromise response requires analysing the sequence of login and follow-on actions. | |
| Recommendation — Tune detection for anomalous users, devices, and connections during account compromise. Investigate the account timeline to determine scope, persistence, and impact. | ||
Practitioner Guidance
What to verify: Confirm whether the suspicious sign-in was followed by mailbox rule creation, forwarding changes, new app consent, or unfamiliar file access. Those post-login actions usually matter more than the login event alone because they show whether the attacker converted access into control.
Decision rule: If the account shows new persistence settings, revoke sessions and tokens first, then rotate credentials and inspect connected applications before treating the incident as closed. If the evidence is limited to a single anomalous login with no downstream activity, containment can be narrower, but only after a full log review.
Practitioner takeaway: The key judgment is whether the compromise produced durable access or just a brief login. If the account changed its own behavior after sign-in, assume the attacker was already using it as an active foothold.
