M365 Adversary ROI: Microsoft Cloud Attack Insights
summary
Ten years of adversary ROI work plus 18 months of telemetry from tens of thousands of M365 incidents show attackers shift to high scale cloud pivots: initial bespoke Microsoft 365 exploits cost an estimated $30–40M then copy‑paste to hit hundreds of thousands of tenants, with 345 million monthly users. Real attacks use the Graph API to change OneDrive versioning, Power Automate for stealthy persistence, and Exchange legacy protocols; Vectra publishes the open source MAAD Attack framework to simulate and harden against these methods.
AI-written summary · about
chapters (12)
- 0:00Introduction and speakers
- 1:46Adversary ROI model origins
- 7:45Cloud attack surface growth
- 17:22LastPass breach insights
- 21:59Microsoft 365 scale impact
- 25:11Nation state cloud attacks
- 30:54Ransomware via cloud APIs
- 34:22Dark Halo and SolarWinds
- 37:56Disinformation in Exchange Online
- 40:52Applying model to defense
- 43:22MAAD Attack Framework demo
- 44:44Closing and Q&A
related talks
50mAttacking and Defending the Microsoft Cloud (Office 365 & Azure AD)
40mFighting Where They Aren't: How Attackers Avoid Endpoints in Modern Attacks
40mWhat’s Old is New: Hybrid Security for Microsoft Azure and On-Premises Tech
44mM365 Threat Hunting—How to Understand Attacker's TTPs in Your Tenant
55mAzure Attacks Unpacked: Real-World Threats & Lessons
35mThe Dark Side of Cloud Computing: How Threat Actors Abuse Millions of Dollars of Cloud Compute
55m52 mins from initial access to ransomware - is your defensive team ready?
48mLateral Movement in the Age of Hybrid Cloud