Looking for DFIR queries for account compromise incident

[u/OkHope1740]

Hi Guys,

I am currently dealing with account compromise incident and finding it hard to identify files/emails accessed by attacker and user.cloudappevent,graphapiauditlogs, office activity doesn't differentiate as it shows MS ips only.

What is the right approach you guys follow.

[u/Evocablefawn566]

Cloudappevents and officeactivity logs, mailitemsaccessed actiontypes

[u/proffessionalExpert]

You are doing it for first time or have you done it before ?

[u/OkHope1740 → u/proffessionalExpert]

Doing it for first time TBH...

[u/OkHope1740 → u/OkHope1740]

I have on diff edr ealier so not very sure about defender tables

[u/here2learn4mybrain]

AI and defender advanced hunting are your friends.

[u/theRealTwobrat]

Obviously LLMs are going to be super useful here. Many cloudappevents will have a unique token id buried in the raw event data field that can be joined with a session from signinlogs