Loot Exchange, Teams and SharePoint with GraphRunner

What this lab covers

You start from a set of credentials obtained through phishing, establish which Microsoft services they can reach without a second factor, and use Graph-based tooling to search and extract data from mail, chat and document storage before moving into a database.

The productivity suite is the point. Attackers who reach a dead end escalating in the cloud infrastructure frequently find everything they need in what people wrote to each other.

It assumes basic Windows command line familiarity and suits defenders responsible for Microsoft 365 as much as red teamers.

How Microsoft 365 data collection works

Microsoft Graph is a single API surface across mail, chat, files, calendar and directory. That is excellent for developers and equally useful to an attacker, since one token and one interface reach everything the account can see, with search built in.

Coverage gaps are the enabler. Multi-factor authentication is applied per policy rather than universally, so it is common for one service, one client type or one legacy protocol to remain reachable without a second factor. Tooling exists specifically to test each service and report which accept a password alone.

The data itself is the objective. Mail contains credentials sent to colleagues and system notifications. Chat contains the informal conversations where people paste things. Document libraries contain architecture, contracts and customer records. None of it requires escalation to read once the account is held.

How to detect this in your own environment

Watch for bulk access patterns in Microsoft 365 audit logs: large-scale mail searches, mass file downloads and broad chat retrieval. These are recorded and are quite unlike normal user behavior, which is bursty and narrow.

Alert on new applications being granted access to Graph on behalf of a user. Consent to a third-party application is a persistence mechanism that survives password changes and is rarely reviewed.

Correlate an unusual sign-in with the activity that follows. A sign-in from a new location followed by broad searching across services is a far stronger signal than either alone.

How to prevent it

Close the coverage gaps first. Verify by querying sign-in logs for successful authentications without a second factor rather than by reviewing policy, and block legacy authentication protocols outright.

Restrict user consent for third-party applications, so an attacker cannot establish durable Graph access by having the user approve an application.

Apply data governance so the productivity suite stops holding the crown jewels in plain text. Sensitivity labeling, retention limits and a genuine secrets management practice all reduce what a compromised mailbox is worth.

Real-world context

Business email compromise remains one of the most financially damaging categories of attack reported to law enforcement, and mailbox access is the common ingredient. The value is in the contents rather than in any further escalation.

The migration to hybrid architectures is what created the exposure at scale. Organizations moved mail, files and chat into one platform with one identity, which is operationally excellent and means a single credential now reaches what used to be several separate systems.

The pattern maps to MITRE ATT&CK T1114 Email Collection, T1213 Data from Information Repositories and T1078.004 Cloud Accounts.

Applying this at work

• Query sign-in logs for successful authentications without multi-factor authentication, per service, and close every gap you find.
• Block legacy authentication protocols tenant-wide, handling exceptions individually.
• Restrict user consent for third-party applications and review existing grants.
• Alert on bulk mail search, mass file download and broad chat retrieval.
• Search your own document libraries and chat for credential-shaped content, and give people a better place to put secrets.

Frequently asked questions

Why is Microsoft Graph useful to an attacker?

Because it provides one authenticated interface across mail, chat, files and directory, with search included. A single token reaches everything the account can see, which removes the need to interact with each service separately.

How do MFA coverage gaps arise in Microsoft 365?

Because policies apply per user, application and client type. One service, one legacy protocol or one excluded account can remain reachable with a password alone, and tooling exists specifically to find which.

What limits the damage of a compromised mailbox?

Reducing what it contains. Sensitivity labeling, retention limits and a real secrets management practice mean a mailbox holds less worth stealing, which matters because no access control prevents the legitimate owner reading their own mail.

Do I need my own Microsoft 365 tenant to practice this?

No. The lab runs in a live environment that Pwned Labs provisions for you, so there is nothing to set up and no risk to your own tenant.

Which certification covers this in depth?

The Microsoft Cloud Red Team Professional (MCRTP) covers Entra ID, Azure and Microsoft 365 attack paths in full, including token abuse, phishing tradecraft and privilege escalation, and is assessed hands-on in a live tenant.