Now we’re getting somewhere. A Look At Additional Log Sources

For organizations using Microsoft Entra ID (the artist formerly known as Azure Active Directory) and O365, it’s fairly well understood that a set of default logs are readily available for use, no matter what log management tooling an organization is using. However, this standard logging has its limits. With the release of post exploitation kits like GraphRunner, which is focused on interacting with the Microsoft Graph API, the backbone that services Entra ID, O365 and more; probing and information gathering is streamlined. Further, while GraphRunner is a post exploitation toolkit, there are authentication functions available in it that highlight how adversaries could use the OAuth authorization code flow to their advantage. Join this webinar to learn about the kinds of capabilities GraphRunner brings while identifying events that defenders can use to hunt and detect suspicious activities in an Entra ID / O365 tenant.