M365 Threat Hunting—How to Understand Attacker's TTPs in Your Tenant
summary
Covers practical steps to prepare and protect a Microsoft 365 tenant and methods for threat hunting within Microsoft 365 services and settings, focusing on identifying attacker TTPs across the M365 environment. Discusses managing M365 risk and handling the complexity of M365 service configurations to enable active hunting despite limited security team resources.
AI-written summary · about
chapters (9)
- 0:00Start
- 6:27Attackers Targeting Microsoft SaaS Platforms
- 7:26Increasing Velocity and Efficiency of M365 Attacks
- 9:31Common M365 Attack Paths
- 15:09Key Capabilities
- 19:29PowerShell / GraphAPI Conundrum
- 26:03Threat Hunting Scenario
- 29:01M365 Threat Hunting Action Plan
- 31:55Questions & Staying In Touch
related talks
45mM365 Adversary ROI: Microsoft Cloud Attack Insights
31mThreat Hunting — Demystified
46mWhat's new in Microsoft Threat Protection
51mEnabling Protection, Detection and Response to Cyber-Threats
42mPractical Threat Hunting: Straight Facts and Substantial Impacts
34mFormulating An Intelligence-Driven Threat Hunting Methodology
31mDon't Boil the Ocean: Using MITRE ATT&CK to Guide Hunting Activity
40mHunt and Gather: Developing Effective Threat Hunting Techniques