Microsoft 365

See below for a list of Microsoft 365 Tools.

Tool	Description
Blue-team-app-Office-365-and-Azure	The Blue team app for Office 365 and Azure is developed to help you investigate the Microsoft 365 Audit log.
GraphRunner	A Post-exploitation Toolset for Interacting with the Microsoft Graph API A Defenders Guide to GraphRunner — Part I A Defenders Guide to GraphRunner — Part II
Microsoft-Extractor-Suite	A PowerShell module for acquisition of data from Microsoft 365 and Azure for Incident Response and Cyber Security purposes.
O365 Python Parser	Parsing O365 UAL using Python
OneDriveExplorer	Command line and GUI based application for reconstructing the folder structure of OneDrive What's New in OneDriveExplorer OneDriveExplorer ODL Parsing Issues

See below for a list of Microsoft 365 Artifacts.

Artifact or Process	Resource
Email Forensics	Email Forensics – Definition and Guideline - Salvation Data
Email Forensics	Techniques In Email Forensic Analysis
Email Forensics	Email Header Forensic Analysis - Joseph Moronwi
Email Forensics	Investigating Suspicous Emails!
Email Forensics	Phishing emails – a breakdown from an Incident Responder getting phished: Part 1.
EnrichedOffice365AuditLogs	The mystery of the EnrichedOffice365AuditLogs solved
MailItemsAccessed	Everything you need to know about MailItemsAccessed and more
MailItemsAccessed	MailItemsAccessed Woes: M365 Investigation Challenges
Microsoft Office	An Inside View of Office Document Cache Exploitation
Microsoft Office	Investigating Microsoft Office - Forensafe
Microsoft OneDrive	OneDrive and NTFS last access timestamps
Microsoft OneDrive	Investigating OneDrive
Microsoft OneDrive	Reading OneDrive Logs: Part 1 Part 2 - SwiftForensics
Microsoft OneDrive	The $MFT flag that you have never considered before – OneDrive not synchronized files. - CyberDefNerd
Microsoft OneDrive	Recreating OneDrive’s Folder Structure from .dat
Microsoft OneDrive	Reading OneDrive Logs - SwiftForensics
Microsoft Outlook	Investigating Outlook Windows Application
Microsoft Teams	Microsoft Teams artifacts and chat logs
Microsoft Teams	Microsoft Teams and Skype Logging Privacy Issue
Microsoft Teams	Microsoft Teams Logs for Activity
Microsoft Teams	Collecting from Microsoft Teams using PowerShell
Microsoft Teams	MS Teams Desktop Forensic - Misconfig
Microsoft Teams	Investigating Microsoft Teams IndexedDB Data
Unified Audit Log (UAL)	Wrangling the M365 UAL with PowerShell and SOF-ELK (Part 1 of 3)
Unified Audit Log (UAL)	Wrangling the M365 UAL with SOF-ELK on EC2 (Part 2 of 3)
Unified Audit Log (UAL)	Wrangling the M365 UAL with SOF-ELK and CSV Data (Part 3 of 3)
Unified Audit Log (UAL)	What DFIR experts need to know about the current state of the Unified Audit Log