Hacked accounts in O365

[leewakelam]

Is there any way to automate the process of seeing hacked accounts? 

 

We currently use the process below but its manual and we miss this from time to time. I'm not sure if there is a better way. We have an A3 licence 

 

Log onto Admin 365 – show all – identity 

Users all users – sign-in logs

Add filters

‘Location’ & apply

Click on the ‘location’ filter you have just created 

Change the country/Region to ‘US’ and apply (US in capitals)

Add filters

‘Status’ & apply

Click on the ‘status’ filter you have just created 

‘tick’ both ‘success’ & ‘interrupted’

Now you can see the hacked account's 

[TechMonkey]

Can you expand on how this shows hacked accounts?  My understanding is this will just show logins signing in from the US. Unless you have blocked countries abroad, a user could have a VPN or even just be misidentified.

I don't know how the process works but A5 or A5 Security has automated investigation & response.

[MYK-IT]

@leewakelam If you have A3 licencing, your priority is to get MFA enabled and Conditional Access Rules applied (e.g. outside trusted IP, non-compliant device etc) as a minimum. Then work from there for alerts (e.g. risky sign-ins, bespoke alerts etc).

[leewakelam]

We have got MFA for staff setup and Conditional Access for UK only. have you got any examples of non-compliant device in conditional access?

[leewakelam]

how can you setup alerts for  risky sign-ins?

[leewakelam]

16 minutes ago, TechMonkey said:

Can you expand on how this shows hacked accounts?  My understanding is this will just show logins signing in from the US. Unless you have blocked countries abroad, a user could have a VPN or even just be misidentified.

I don't know how the process works but A5 or A5 Security has automated investigation & response.

We have blocked everywhere apart from the UK but a VPN could get around this. Unfortunately we don't have the A5 due to costs 

[ITGuyNW]

I just check risky logins every now and again. Very good for finding out that students are in Spain when they've rung school to say they're ill/bereavement.

[MYK-IT]

Within Microsoft Defender (security.microsoft.com) - Maybe A5 only???

 

Cloud Apps > Policies > Policy Management

I've setup numerous policies that create an alert (with email notification) when for example, someone logs in outside UK, key staff have logged in etc.

 

Within Microsoft Entra

 

Protection > Risky Activities > Risky Users / Risky sign-ins

 

For conditional access, various ways of detecting for a compliant device. For example, if you wanted to block, or apply a conditional access rule to apply to a personal device only, you could use Filter for Devices, and use Rule syntax device.trustType -ne "AzureAD" -and device.trustType -ne "ServerAD" which just means any device that is not 'Microsoft Entra Joined' or 'Microsoft Entra Hybrid Joined'. You could expand on that to stipulate OS type, version etc. Just don't go locking yourself out, by ensuring you exclude 'break glass' accounts within your Conditional Access Rules!

 

Just to note, that no matter what security protection measures you put in place (e.g. MFA, Conditional Access Rules. Even if they all work, you will still always have sign-in activity of legitimate and illegitimate (attempted) access. The key thing to look for, is 'if' an illegitimate login attempt was successful - then you know it has been compromised.