mvexpand valueExtracted

In our previous blog post, we delved into common initial access techniques targeting Microsoft 365 (M365) tenants and provided blue teams with comprehensive detection strategies to identify them. For a robust M365 detection strategy, defenders should complement these capabilities and account for post-exploitation tactics, enabling them to hunt for adversaries who have an active foothold on the environment and are looking to achieve their objectives.