What was reported
Huntress reports Microsoft 365 session replay and devices and MFA methods registered by attackers.
Applicability and impact
Business impact can include mailbox access, impersonation and fraud. Confirm activity in your own tenant; an unusual IP address or location alone does not establish session theft.
What to check and remediate
- Check: correlate interactive and non-interactive sign-ins with Entra and Exchange audit logs. Look for unexpected device registrations, MFA methods and inbox rules; retain exports and the reviewed time window.
- Contain: with the tenant administrator, revoke sessions and reset affected credentials; restrict the account if evidence warrants it. Verify the effect in applications because revocation is not instantaneous in every scenario.
- Remove persistence: after preserving evidence, remove unauthorized devices, MFA methods, forwarding rules and suspicious delegated access.
- Prevent: pilot phishing-resistant MFA and Conditional Access. Evaluate Token Protection only for supported application, device and license combinations; do not assume universal coverage.
- Validate: confirm approved methods and a fresh legitimate sign-in; check old access and monitor for reappearing suspicious rules or devices. Use test accounts for control scenarios.
Closure covers both access and persistence. A password reset, MFA enrollment or new policy alone does not demonstrate that every attacker session has ended.
How weownit.net can help
weownit.net can structure triage, the timeline and a containment plan with the identity administrator. Tenant changes and specialist Microsoft 365 investigation are explicitly scoped.
Proposed deliverables- Timeline with log sources and affected identities
- Revocation and persistence-removal checklist
- Validation criteria and a monitoring owner
Availability and scope are agreed before work starts. This form is not an emergency channel.
Sources and boundaries
Huntress ↗ · Microsoft Learn — Revoke access ↗ · Microsoft Learn — Token Protection ↗
Editorial synthesis of the cited research. Applicability, checks and proposed deliverables are weownit.net recommendations, separate from the source findings. No assessment of your systems has been performed.