Microsoft 365 Unified Audit Log Forensics: How to Extract Attacker Activity from UAL Records During Incident Response

The UAL is enabled by default in most M365 tenants, but should be verified:

# Connect to Security & Compliance PowerShell
Connect-IPPSSession -UserPrincipalName admin@domain.com

# Check if audit logging is enabled for the tenant
Get-AdminAuditLogConfig | Select-Object UnifiedAuditLogIngestionEnabled

# Enable if disabled
Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true

# Check if mailbox audit logging is enabled for a specific user
Get-Mailbox -Identity user@domain.com | Select-Object AuditEnabled, AuditAdmin, AuditDelegate, AuditOwner

Mailbox-level audit logging captures owner actions (the user logging in to their own mailbox), delegate actions (someone with Send As or Full Access permissions), and admin actions. By default, owner actions are not all audited. Check the AuditOwner property -- if it does not include MailItemsAccessed, MoveToDeletedItems, SoftDelete, and HardDelete, update it:

Set-Mailbox -Identity user@domain.com -AuditOwner @{Add="MailItemsAccessed","MoveToDeletedItems","SoftDelete","HardDelete"}

Note: MailItemsAccessed requires a Microsoft 365 E5 or Purview Audit Premium license. Without this license, forensic coverage of which specific emails were read is not available.

After compromising an M365 account, attackers almost always create inbox rules to hide replies, forward emails, or delete detection alerts:

# Find inbox rule creation events for a specific user over the last 90 days
$rules = Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-90) -EndDate (Get-Date) `
    -Operations "New-InboxRule","Set-InboxRule","UpdateInboxRules" `
    -UserIds "compromised.user@domain.com" `
    -ResultSize 5000

# Parse the AuditData JSON for each result
$rules | ForEach-Object {
    $data = $_.AuditData | ConvertFrom-Json
    [PSCustomObject]@{
        Time = $_.CreationDate
        User = $_.UserIds
        Operation = $_.Operations
        RuleName = $data.Parameters | Where-Object {$_.Name -eq "Name"} | Select-Object -ExpandProperty Value
        ForwardTo = $data.Parameters | Where-Object {$_.Name -eq "ForwardTo"} | Select-Object -ExpandProperty Value
        DeleteMsg = $data.Parameters | Where-Object {$_.Name -eq "DeleteMessage"} | Select-Object -ExpandProperty Value
        MoveToFolder = $data.Parameters | Where-Object {$_.Name -eq "MoveToFolder"} | Select-Object -ExpandProperty Value
        SubjectFilter = $data.Parameters | Where-Object {$_.Name -eq "SubjectContainsWords"} | Select-Object -ExpandProperty Value
        ClientIP = $data.ClientIP
    }
} | Format-Table -AutoSize

High-priority findings:

• ForwardTo set to an external address: active email exfiltration
• SubjectContainsWords matching 'invoice', 'payment', 'wire', 'bank': BEC targeting filter
• DeleteMessage True with SubjectContainsWords matching security alert terms: detection evasion

Consent phishing attacks trick users into granting a malicious OAuth application full access to their mailbox. The UAL captures both the consent event and subsequent application access:

# Find all OAuth application consent events in the last 90 days
$consent = Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-90) -EndDate (Get-Date) `
    -Operations "Add app role assignment grant to user","Consent to application","Add delegated permission grant" `
    -ResultSize 5000

$consent | ForEach-Object {
    $data = $_.AuditData | ConvertFrom-Json
    [PSCustomObject]@{
        Time = $_.CreationDate
        User = $_.UserIds
        AppName = $data.Target | Where-Object {$_.Type -eq 2} | Select-Object -ExpandProperty ID
        Permissions = $data.ModifiedProperties | Where-Object {$_.Name -eq "Included Updated Scopes"} | Select-Object -ExpandProperty NewValue
        ClientIP = $data.ActorIpAddress
    }
} | Format-Table -AutoSize

# Once you have a suspicious app name, find all API access it performed
$appAccess = Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-90) -EndDate (Get-Date) `
    -Operations "MailItemsAccessed" `
    -FreeText "suspicious-app-display-name" `
    -ResultSize 5000

Cross-reference consent events with Graph API sign-in logs to determine the access scope the application actually used after consent was granted.

Attackers who gain account access often add a secondary MFA method to maintain persistence after the victim's password is changed:

# Find authentication method additions and removals (Entra ID operations in UAL)
$mfaChanges = Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-90) -EndDate (Get-Date) `
    -Operations "User registered security info","User deleted security info","User registered all required security info","Admin updated security info","Admin deleted security info" `
    -ResultSize 5000

$mfaChanges | ForEach-Object {
    $data = $_.AuditData | ConvertFrom-Json
    [PSCustomObject]@{
        Time = $_.CreationDate
        TargetUser = ($data.ObjectId)
        Actor = $_.UserIds
        Operation = $_.Operations
        Method = $data.AdditionalDetails | Where-Object {$_.key -eq "Type"} | Select-Object -ExpandProperty value
        ClientIP = $data.ActorIpAddress
    }
} | Format-Table -AutoSize

For each MFA registration event:

1. Correlate the actor IP with the user's normal login IP pattern (from Entra ID sign-in logs)
2. If the actor is the same as the target user (self-registration), check whether the IP is consistent with the user's normal locations
3. If the actor is not the target user (admin registration), verify the action was authorized
4. Registration of a new authenticator app from an unfamiliar IP immediately after an account compromise is a strong persistence indicator

Data staging and exfiltration through SharePoint and Teams produces distinct audit event patterns:

# Detect mass file downloads from SharePoint (more than 50 files in one hour)
$spDownloads = Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-7) -EndDate (Get-Date) `
    -RecordType SharePointFileOperation `
    -Operations "FileDownloaded" `
    -ResultSize 5000

$spDownloads | ForEach-Object {
    $data = $_.AuditData | ConvertFrom-Json
    [PSCustomObject]@{
        Time = $_.CreationDate
        User = $_.UserIds
        File = $data.SourceFileName
        SiteURL = $data.SiteUrl
        ClientIP = $data.ClientIP
        Hour = [datetime]::Parse($_.CreationDate).ToString("yyyy-MM-dd HH")
    }
} | Group-Object User, Hour | Where-Object {$_.Count -gt 50} |
    Select-Object @{N='User';E={$_.Name.Split(',')[0]}},
                  @{N='Hour';E={$_.Name.Split(',')[1]}},
                  @{N='FileCount';E={$_.Count}} |
    Sort-Object FileCount -Descending

# Teams channel message exports (used to stage conversation data)
$teamsExport = Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-7) -EndDate (Get-Date) `
    -Operations "MessagesExported","ChatRetrieved" `
    -ResultSize 1000

For SharePoint mass download incidents, also check whether the downloads used a browser (identifiable by user agent in ClientIP metadata) or a scripted tool -- scripted downloads typically show consistent per-second request rates that differ from human browsing patterns.