Skip to content
BreachPathAttack Path LibraryStart
IntermediateData theftAccount takeover

Microsoft 365 account to sensitive data

A phished Microsoft 365 identity is turned into durable access, used to discover where sensitive data lives in SharePoint and Teams, and finally to quietly extract it — all without dropping malware.

Technologies
Microsoft 365, Azure
Entry points
Phishing, Stolen credentials
Sectors
Legal, Financial services, Professional services…
Stages
4
01

Credential phishing lands a Microsoft 365 identity

The attacker sends a lure that leads to a look-alike Microsoft sign-in experience. A real employee authenticates, and the attacker captures both the password and, in adversary-in-the-middle style lures, the resulting session — enough to act as that user.

Attacker objective

Obtain valid credentials for a real user by capturing them through a convincing sign-in lure.

MITRE ATT&CK
Controls that should stop this
  • Phishing-resistant MFA (FIDO2 / passkeys) rather than SMS or push-only
  • Conditional Access requiring compliant or managed devices for M365 sign-in
  • User reporting button and fast triage of reported lures
What defenders should see
  • Entra ID sign-in logs showing new/unusual location, ASN or impossible travel
  • Sign-ins from anonymising infrastructure or unfamiliar user agents
  • Spike in authentications flagged as risky by identity protection
What a pentest validates
  • A social-engineering assessment measuring click, submit and report rates
  • Testing whether MFA method in use can be relayed or bypassed
  • Reviewing Conditional Access coverage for gaps and exclusions
Business impact

The attacker now holds a legitimate identity — every later action looks like a real employee.

02

OAuth application consent establishes persistence

Rather than rely on the stolen password, the attacker registers or consents an OAuth application against the account, granting it standing access to mail and files. Because this uses a token grant rather than the password, resetting the password alone does not evict them.

Attacker objective

Keep durable access to the mailbox and files that survives a password reset, without needing to re-enter credentials.

MITRE ATT&CK
Controls that should stop this
  • Restrict user consent to verified publishers; require admin approval for new app grants
  • Regular review of enterprise application and OAuth grants
  • Revoke sessions and refresh tokens as part of any account-compromise response
What defenders should see
  • Audit events for new service principal / application consent grants
  • Unusual application permissions requesting mail.read or files.read.all
  • Token grants from a session that was already flagged as risky
What a pentest validates
  • Assess whether end users can consent apps to sensitive scopes unassisted
  • Validate that incident response revokes tokens, not just passwords
  • Enumerate existing OAuth grants for over-privileged or stale applications
Business impact

Persistence is now decoupled from the password — remediation that only resets credentials will fail.

03

SharePoint and Teams discovery locates the crown jewels

Using the compromised identity, the attacker browses accessible SharePoint sites, Teams channels and shared mailboxes, searching for terms that signal sensitive material — contracts, financials, credentials stored in documents, and privileged correspondence.

Attacker objective

Find where the valuable data actually lives before touching it, to move straight to the highest-value targets.

MITRE ATT&CK
Controls that should stop this
  • Least-privilege sharing and site permissions; remove broad 'everyone' access
  • Sensitivity labelling and data loss prevention on high-value repositories
  • Restrict and monitor large-scale search and file enumeration
What defenders should see
  • Unusual volume of file access or search across many sites in a short window
  • Access to repositories the user has never touched before
  • DLP policy matches on sensitive document access
What a pentest validates
  • Map what a single compromised standard user can actually reach
  • Test whether sensitive repositories are discoverable by internal search
  • Check for credentials and secrets stored inside documents
Business impact

The attacker now knows exactly where the valuable data is — and whether one identity is enough to reach it.

04

Sensitive data is quietly extracted

The attacker collects the located files and messages and moves them out — via bulk download, mailbox forwarding, or sync to attacker-controlled storage — pacing the activity to avoid obvious spikes.

Attacker objective

Remove the identified data in a way that blends in with normal cloud activity.

MITRE ATT&CK
Controls that should stop this
  • DLP egress controls and blocking of unmanaged sync clients
  • Alerting and blocking on auto-forwarding rules to external domains
  • Download-volume throttling and session controls via a cloud access broker
What defenders should see
  • Large or anomalous download / export volume from cloud storage
  • New external mail-forwarding or inbox rules
  • Data egress to unfamiliar cloud storage destinations
What a pentest validates
  • Attempt a controlled, authorised exfiltration to test detection and blocking
  • Verify alerts fire on forwarding-rule creation and bulk download
  • Confirm whether egress DLP covers the real data locations found earlier
Business impact

Confidential data leaves the tenant — triggering breach-notification, regulatory and client-trust consequences.

ATT&CK techniques in this chain

T1078.004Valid Accounts: Cloud AccountsT1567.002Exfiltration Over Web Service: Cloud StorageT1114.002Email Collection: Remote Email CollectionT1566.002Phishing: Spearphishing LinkT1098.003Account Manipulation: Additional Cloud RolesT1550.001Use Alternate Authentication Material: Application Access TokenT1087.003Account Discovery: Cloud AccountT1213.002Data from Information Repositories: SharePoint

If this chain completes

Exfiltration of confidential client, financial or personal data from a cloud identity, with persistence that survives a password reset — often invisible unless cloud audit logging and identity alerting are switched on and reviewed.

Should you test this against your environment?

Turn this chain into a scoped red-team brief — objective, systems and identities in scope, testing assumptions and the questions to answer before commissioning.

Generate my red-team test briefExplore more paths