{"id":36588,"date":"2026-06-15T17:49:36","date_gmt":"2026-06-15T15:49:36","guid":{"rendered":"https:\/\/www.abd.es\/?p=36588"},"modified":"2026-07-13T13:18:29","modified_gmt":"2026-07-13T11:18:29","slug":"detectar-actividad-sospechosa-microsoft-365","status":"publish","type":"post","link":"https:\/\/www.abd.es\/en\/2026\/06\/detectar-actividad-sospechosa-microsoft-365\/","title":{"rendered":"How to spot suspicious activity in Microsoft 365 and Outlook"},"content":{"rendered":"

The security of corporate email accounts has become one of the main targets for cybercriminals. In Microsoft 365 environments, just a single compromised credential can lead to the theft of confidential information, financial fraud, lateral access to other cloud services, and the exfiltration of SharePoint and OneDrive documents.<\/p>\n

One of the biggest problems is that many modern attacks don't cause obvious symptoms. The attacker doesn't need to break the system: it's enough to gain legitimate access through phishing, session cookie theft, infostealer-type malware, or MFA fatigue attacks.<\/p>\n

\"actividad<\/p>\n

How to commit a Microsoft 365 account<\/h2>\n

Main techniques for attacking corporate accounts<\/h3>\n

The main methods include classic phishing, session token theft, password spraying, and malicious OAuth consent.<\/p>\n

Session token theft is especially dangerous because it lets the attacker get in even when MFA is turned on.<\/p>\n

Check suspicious sign-ins in Microsoft 365<\/h2>\n

Microsoft Entra ID allows you to review the Sign-in Logs from https:\/\/entra.microsoft.com<\/a>.<\/p>\n

The most important indicators to check are:<\/p>\n