Detecting Microsoft 365 Privilege Escalation Techniques w/ Purav Desai ~ Detection Opportunites EP 5

Learn how to decipher the Microsoft Unified Audit Log (UAL) from a Digital Forensics & Incident Response (DFIR) perspective with Purav Desai, an experienced M365/Azure Incident Responder.


Purav's LinkedIn: https://www.linkedin.com/in/purav-da346393/
Deciphering UAL: https://github.com/PuravsPoint/DecipheringUAL



TIMESTAMPS:
00:00 Intro
00:20 Deciphering New-RoleGroup
09:06 Key Fields
10:11 Deciphering with Exchange OnlinePowershell
13:42 Detection Opportunities
16:16 SIEM & Attacker Tactics
21:43 Outro



_____________
⚙️ OTHER RESOURCES

🔹My Content Equipment, Book Recommendations & Desk Setup: https://www.amazon.com/shop/daycyberwox

_____________
⚡️JOIN CYBERWOX ACADEMY ON DISCORD!
https://discord.gg/cyberwoxacademy
_____________
📱 LET'S …

amp audit azure detection detection opportunities dfir digital digital forensics escalation exchange forensics incident incident responder incident response intro key learn log m365 microsoft microsoft 365 opportunities perspective privilege privilege escalation responder response siem techniques timestamps