Comprehensive Guide to Investigating and Mitigating an Azure User Account Compromise - ToddMaxey/Technical-Documentation GitHub Wiki

Comprehensive Guide to Investigating and Mitigating an Azure User Account Compromise

Ensuring Complete Threat Actor Removal with Verified Investigation and Remediation Procedures

Introduction

A compromised Azure user account presents a severe security risk, as attackers may persist via refresh tokens, OAuth applications, inbox forwarding rules, or privileged role assignments. Simply resetting a password is insufficient unless proper revocation, investigation, and remediation steps are taken.

This guide provides a methodology to detect, analyze, and eliminate attacker persistence while ensuring the affected user(s) can securely regain control. It is structured to cover:

  1. Hunting compromised user accounts using Azure logs

  2. Single-user account compromise response

  3. Multi-user compromise response (organization-wide remediation)

  4. Azure-only vs. Hybrid Azure AD + On-Premises AD considerations

  5. Handling environments with and without Self-Service Password Reset (SSPR)

  6. A fully automated PowerShell script to execute the remediation process

Part 1: Investigating and Hunting Compromised Users in Azure

Before remediation, it's critical to determine the full scope of compromise by leveraging Azure Sign-in Logs, Azure Audit Logs, and the Unified Audit Log (UAL) via the Microsoft Defender Portal.

Key Indicators of Compromise

Use the following markers to identify malicious activity:

✅ Date/Time of Suspicious Activity – Identify when the first unauthorized login occurred.

✅ IP Address & ASN (Autonomous System Number) – Detect whether logins originated from unusual ISPs or locations.

✅ Geo Location – Identify foreign or impossible travel logins.

✅ Operating System & Device Information – Check if the attacker used a different OS/device than the legitimate user.

✅ SessionID & Token Persistence – Identify and revoke suspicious sessions.

✅ Unusual App & OAuth Activity – Check for unauthorized consent to third-party applications.

Step 1: Identifying Suspicious Logins Using Azure AD Sign-In Logs

Azure AD Sign-In Logs contain rich forensic data that can help pinpoint a compromise.

1.1: Find All Sign-ins from a Compromised User

  1. Navigate to the Microsoft Defender Portal

  2. Go to Audit > Search

  3. Use the following query filters:

    • "User: [email protected]"

    • "Operation: UserLoggedIn"

    • "IP Address: <suspicious_ip>"

    • "Device Information: Not matching known devices"

  4. Export results as CSV and analyze in Excel using filters.

1.2: Identify Impossible Travel & Unusual Geolocations

  • Filter login timestamps in Excel

  • Identify logins from two distant locations within an impossible timeframe

1.3: Detect Logins from Risky ASNs (ISP Providers)

  • Identify logins from known malicious ASN ranges

  • Flag logins from AWS, Azure, DigitalOcean, or unknown ISP providers

Step 2: Investigating Azure AD Audit Logs for Configuration Changes

Azure AD Audit Logs capture changes to user accounts, roles, and security policies.

2.1: Detect Suspicious Role Elevations

  • Search for "Operation: Add member to role"

  • Identify Global Admin or Security Admin additions

2.2: Identify New OAuth Applications Granted by the User

  • Search for "Operation: Consent to application"

  • Look for unknown applications or unusual API scopes

Step 3: Investigating Unified Audit Logs (UAL) in Defender Portal

The Unified Audit Log (UAL) aggregates data from Azure AD, Exchange, SharePoint, Teams, and OneDrive.

3.1: Identify Forwarding Rules in Exchange Online

  • Query "Operation: New-InboxRule"

  • Detect email forwarding to external addresses

3.2: Detect Password Resets Performed by Attacker

  • Query "Operation: ResetUserPassword"

  • Identify unauthorized password resets

3.3: Detect Suspicious Mailbox Access

  • Query "Operation: MailboxLogin"

  • Flag logins from unknown locations/IPs

Part 2: Remediating a Single Azure User Account Compromise

Step 1: Immediate Containment to Cut Off Attacker Access

The first priority is to fully revoke any active attacker sessions and tokens before proceeding with further remediation.

1.1: Revoke All Active Sessions and Authentication Tokens

Revoke-MgUserSignInSession -UserId "[email protected]"

Hybrid AD Note:

If using on-prem AD with Pass-Through Authentication (PTA) or Federation, revoke ADFS tokens and terminate active VPN sessions.

Step 2: Secure Password Reset and Enforce MFA Re-Registration

If SSPR (Self-Service Password Reset) is enabled, the attacker may attempt to reclaim access.

Update-MgUser -UserId "[email protected]" -PasswordProfile @{ 

    Password = "NewSecureP@ssw0rd" 

    ForceChangePasswordNextSignIn = $true 

} 

Get-MgUserAuthenticationMethod -UserId "[email protected]" | ForEach-Object { 

    Remove-MgUserAuthenticationMethod -UserId "[email protected]" -AuthenticationMethodId $_.Id 

}

Step 3: Remove Persistence Mechanisms

3.1: Remove Unauthorized OAuth Applications

Remove-MgUserOauth2PermissionGrant -UserId "[email protected]" -PermissionGrantId "<GrantID>"

3.2: Remove Unauthorized Role Assignments

Remove-MgDirectoryRoleMember -DirectoryRoleId "<RoleID>" -DirectoryObjectId "<UserObjectId>"

3.3: Remove Malicious Email Forwarding Rules

Set-Mailbox -Identity "[email protected]" -ForwardingSmtpAddress $null -ForwardingAddress $null

3.4: Remove Unauthorized Mailbox Delegates

Remove-MailboxPermission -Identity "[email protected]" -User "[email protected]" -AccessRights FullAccess

Step 4: Enforce Security Hardening

✅ Enable Azure AD Conditional Access Policies

✅ Enforce MFA & block legacy authentication

✅ Monitor with SIEM (e.g., Azure Sentinel)

✅ Enable Privileged Identity Management (PIM)

TL;DR

How-To...

✅ Investigate compromised users in Defender Portal using UAL logs

✅ Filter by IP, ASN, OS, SessionID, and operation type

✅ Use Excel to analyze exported logs

✅ Revoke sessions, reset passwords, and remove attacker persistence

✅ Enforce MFA, Conditional Access, and SIEM monitoring

⚠️ **GitHub.com Fallback** ⚠️