How Threat Actors Persist In Your Microsoft 365

The speaker discusses persistence mechanisms in Microsoft 365, specifically focusing on backdoors and breadcrumbs during incident response investigations.

Key Takeaways:
• The presentation covers persistence techniques used by adversaries within the Microsoft 365 environment, including backdoors and breadcrumbs 0:11.
• The speaker, Federico Sedolini, is a senior consultant specializing in digital forensics and incident response, with expertise in M365 security automation 0:20.
• Incident response objectives vary, and investigators must understand the specific persistence methods to effectively track adversary activity 0:51.

This session provides foundational knowledge for securing M365 environments against persistent threats.

Sources:

• 0:11 Introduction to persistence topics: backdoors and breadcrumbs in M365.
• 0:20 Speaker introduction and professional background in digital forensics.
• 0:51 Overview of incident response objectives and investigation goals.