Combating Emerging Microsoft 365 Tradecraft: Initial Access

Huntress outlines advancements in detecting Microsoft 365 initial access by enriching login telemetry with IP intelligence (Spur), building user pattern-of-life baselines, and correlating signals such as VPN/proxy/Tor usage, anomalous geolocations, and conditional access blocks to surface probable account takeovers and credential stuffing while reducing noise; early results show strong contributions to incident detections (37% anomalous location, 15% VPN evasion, 11% credential stuffing), with ongoing efforts to better handle non‑VPN sources and the nuances of "impossible travel."