File activity in SharePoint and OneDrive
After securing the account, investigate relevant file activity as well as email. Record the account, time, file or path, IP and other context available in each event.
FileAccessed- A user or system account accessed a file. Review the context to determine whether it belongs to the unauthorised activity.
FileDownloaded- A file download was recorded.
FileSyncDownloadedFull- A file was downloaded to a computer using the OneDrive sync client. One event does not by itself establish that an entire folder was copied.
File access can expose information even without a separate download event. Keep potentially exposed content distinct from confirmed transfers.
Check connected applications
Single sign-on (SSO) can allow the compromised account to access applications outside Microsoft 365. Entra sign-in records help identify which applications were accessed, while each application’s own logs show activity inside it.
For example, a sign-in to a customer relationship management (CRM) system does not prove that a customer report was exported. Search the system’s activity records for the relevant account and period.
Also review consent and application permissions that could allow automated access to mail or files.
Assess the business impact
Do not assume the attacker had only one goal.
- Financial fraud
- Look for altered payment details, fraudulent invoices or email conversations used to redirect money.
- Outbound phishing
- Check suspicious messages sent from the account and the recipients who may need follow-up.
- Information exposure
- Identify the mail, files or application records potentially accessed, downloaded or shared.
- Continued access
- Check changes that could allow ongoing access or information forwarding.
- 01Observed actionsAccess · downloads · sharing · sending
- 02Affected informationMessages · files · application records
- 03Business assessmentExposure · fraud · follow-up questions
Build a clear account of the findings
- Observed
- What the records directly show, with timestamps and sources.
- Assessed exposure
- What information may be compromised based on the access and surrounding evidence.
- Remaining questions
- What cannot yet be established because evidence is missing or more checks are needed.
- Response and follow-up
- What was secured or removed, and what the relevant teams still need to assess.
Consider whether personal or sensitive information was involved. Provide the findings to the teams responsible for business, privacy and reporting decisions. The impact depends on what information was exposed and how it was used.
Account for log coverage
Document the sources reviewed, their time coverage and known gaps. Include application logs where relevant, rather than stopping at the Microsoft 365 sign-in.
A search with no matching events is only useful when you understand what was recorded and retained. Explain the findings alongside those limits.
Key takeaway
Follow the information across mail, files, sharing and connected applications. Report observed activity, potential exposure, business impact and unresolved questions as distinct parts of the investigation.
Further reading
- Microsoft 365 audit activity reference (opens in a new tab)
- Search the Microsoft Purview audit log (opens in a new tab)
- Respond to a compromised email account (opens in a new tab)
Based on my learning notes from the DFIR BEC investigation track.