Security ArtifactsDFIR Intelligence
SearchSign inSubscribe

Observations

What went wrong, and what to do about it

Real breaches, each put through the same four questions: one control that worked, one that did not, one number worth watching, and what should have been done instead. Every entry cites a primary source, because the point of this section is that you can take it to a meeting.

NO. 02/SaaS / Technology/4 September 2026

One legacy test account, and the OAuth app that reached production

Microsoft Security Response Center post-mortem, January 2024

Midnight Blizzard ran a low-and-slow password spray against a legacy, non-production test tenant in late November 2023 and compromised an account that had no MFA. From there they abused a legacy OAuth application holding elevated permissions into the corporate Exchange Online tenant, and read the mailboxes of senior leadership, legal and the security team itself until detection on 12 January 2024.

What worked

The disclosure. Microsoft published the attack path, named the actor, described the OAuth pivot in technical detail and shipped defender guidance while the eviction was still running. As a piece of post-incident behaviour it set the standard the rest of the industry gets measured against.

What failed

A non-production test tenant was treated as low-risk, and the identity in it was therefore exempt from the MFA policy applied everywhere else. The real failure is the trust relationship: a legacy OAuth application in that throwaway tenant held Office 365 Exchange Online full_access_as_app against the corporate environment, which grants read on any mailbox. The password spray was deliberately low-volume to stay under the alerting thresholds, and it did.

The number

0

MFA factors on the legacy test account that led to the leadership mailboxes.

What to do instead

Inventory the OAuth applications and service principals that cross a tenant boundary, and treat each one as a production identity regardless of which tenant it lives in. "Non-production" describes the workload, never the blast radius of the credentials inside it. Then check your password-spray detection against low-and-slow volumes specifically: a threshold tuned for a noisy spray does not fire on a patient one, and patience is free.

Sources

Named for the doctrine distinction between a lesson observed and a lesson learned: a lesson is not learned until behaviour has changed and somebody has checked. Pretending otherwise is how the same finding turns up in three consecutive post-incident reports.