Episode Details

(00:00:00) Mission Briefing: Protecting Against Tenant Breaches
(00:00:41) The Enemy's Tactics: Consent Phishing and Token Theft
(00:04:35) The Attack Chain: From Consent to Token Abuse
(00:06:22) Detecting and Preventing Consent Phishing
(00:14:41) Lateral Movement: From Mailbox to SharePoint
(00:17:23) Exfiltration and Data Theft
(00:20:26) Implementing Effective Defenses
(00:26:01) Closing Remarks and Key Takeaways

In this episode of M365.fm, Mirko Peters walks through a real‑world style Microsoft 365 breach where attackers combine consent phishing, AiTM token theft, and OAuth abuse to bypass MFA, replay stolen cookies, and quietly live off the land with Microsoft Graph.

WHAT YOU WILL LEARN

• Why perimeter defense and “just add MFA” are lies in modern Microsoft 365 attacks
• How consent phishing, AiTM kits, and multi‑tenant OAuth apps work together to hijack identity and sessions
• Which Entra ID audit and sign‑in events actually matter: “Consent to application”, “ServicePrincipal created”, “AppRoleAssignedTo”, and risky sign‑ins with “requirements satisfied” via cookies
• How attackers use offline_access, refresh tokens, mailbox rules, and scope creep for long‑term persistence
• How Graph, Exchange, and SharePoint telemetry expose mailbox hijack, SharePoint theft, and OAuth‑based exfiltration
• Concrete Sentinel/KQL detection ideas for malicious app consent, token replay, mailbox rule abuse, and Graph exfiltration
• The one policy family that breaks this entire attack chain: consent control and token protection

THE CORE INSIGHT

Most Microsoft 365 breach models still obsess over passwords, URLs, and endpoints. Modern attackers don’t fight your MFA; they reuse your sessions and register their own apps.
The real M365 attack chain is not “phish → malware → lateral movement”, but “consent → token → Graph”: steal a cookie, gain app consent, escalate scopes, and drain data under the cover of normal cloud traffic.
This episode argues that if you’re not governing consent, protecting tokens, and watching service principals, you don’t have a modern M365 defense — you have a firewall nostalgia project.

WHY YOUR CURRENT M365 ATTACK MODEL IS WRONG

• It assumes the front door is the login page, not the consent screen and device code flows
• It treats OAuth apps and service principals as background plumbing, not as first‑class actors in attacks