Happy Little Clouds: Painting Pictures with Microsoft Cloud and Identity Data

Happy Little Clouds: Painting Pictures with Microsoft Cloud and Identity Data

Speakers: Matt Graeber

Conference: fwd:cloudsec North America 2025

YouTube: https://www.youtube.com/watch?v=nwYzVTL8Y4Y

Overview

Matt Graeber, a threat researcher at Red Canary and the person who co-coined the term "living off the land" at DerbyCon years ago, delivered a methodical and deeply technical talk on how to assess, correlate, and tell stories with Microsoft cloud and identity log data. Channeling the spirit of Bob Ross, Graeber presented a universal methodology he calls Minimum Viable Storytelling (MVS) for evaluating whether any given data source contains sufficient context to observe, detect, and respond to threats. The talk then demonstrated this methodology through two practical case studies -- a suspicious inbox rule creation in Exchange Online and a privileged Azure role assignment -- including the specific correlation paths needed to connect events across Microsoft's notoriously siloed log sources.

Background

▶ Watch: Graeber's background: from 'living off the land' to 'living off the logs' (1:30)

Microsoft cloud and identity logging is sprawling, inconsistent, and frequently frustrating for defenders. Data sources span the Unified Audit Log (UAL), Log Analytics tables (interactive sign-in logs, non-interactive sign-in logs, service principal logs, managed identity logs), Azure Activity logs, and Graph Activity logs. Correlation between these sources relies on identifiers like the Unique Token Identifier (UTI), Session ID, and Correlation ID -- each of which behaves differently depending on which Microsoft product generated the event. Many log sources appear designed primarily for troubleshooting and compliance rather than security detection and response, leaving security practitioners to extract value from what they are given.

Graeber's career arc from offensive security research (living off the land) to threat research at Red Canary gives him a distinctive perspective: he now applies the same "use what the vendor gives you" philosophy to defensive log analysis, which he calls "living off the logs."

Key Findings

▶ Watch: Minimum Viable Storytelling template: who, what, when, where, whence, how (13:00)

The central finding is that Microsoft log data can tell a coherent security story, but only if you understand the specific correlation paths between data sources -- paths that Microsoft does not document well. Key discoveries include:

Unique Token Identifier (UTI) provides the highest-fidelity correlation. UTI enables direct, one-to-one correlation from an action event back to a specific sign-in event. In UAL events, the UTI is URL-encoded and base64-encoded and must be decoded to correlate to the ID field in sign-in events. In Azure Activity events, the UTI appears in the claims.uti field. In Log Analytics sign-in events, the UTI is directly available as UniqueTokenIdentifier.

Correlation ID is unreliable across most Microsoft data sources. The field name suggests cross-source correlation, but in practice, Correlation ID behavior varies wildly by product. Sometimes it correlates only within a single Microsoft product, sometimes it's merely a glorified event identifier. However, there is one important exception: Correlation ID does reliably correlate from non-interactive sign-in logs to interactive sign-in logs -- a link that is critical for tracing from an action (like inbox rule creation) back to the original user authentication.

You cannot directly correlate UAL events to interactive sign-in events. To go from a UAL event (e.g., new inbox rule creation) to the corresponding interactive sign-in, you must first correlate to the non-interactive sign-in event (via UTI), then use Correlation ID to reach the interactive sign-in event. This two-hop correlation is necessary because the action is performed by the application (e.g., One Outlook Web) on behalf of the user, generating a non-interactive sign-in event.

Entra ID Audit events lack UTI entirely, making direct correlation to sign-in events impossible from this data source -- a significant gap that Microsoft has not addressed.

Session ID spans up to 90 days and encompasses all tokens from an original sign-in plus all subsequent refresh tokens. This is useful for building holistic timelines for an identity but is too coarse for tactical detection correlation.

Technical Deep Dive

▶ Watch: Correlation ID rant: why it's unreliable across Microsoft products (22:00)

Graeber's Minimum Viable Storytelling template translates raw log events into human-readable narratives using a structured framework: Who (the identity that performed the action), What (the operation performed, including direct object -- the affected resource -- and indirect object -- what was done to it), When (the timestamp of the action, distinguishing ingestion time from occurrence time), Whence (the origin of the actor, typically an IP address), Where (the location of the affected resource, e.g., tenant ID), and How (the means by which the action occurred, e.g., an Entra App ID or user agent string).

Case Study 1: Suspicious Inbox Rule Creation. Starting from a single UAL New-InboxRule event, Graeber populated the MVS template: the CreationTime provided the when, Operation provided the what, the tenant ID the where, the actor Matt@KtosoCorp the who, the IP address the whence, the mailbox the direct object (which resource was affected), the rule name and logic the indirect object (what was done), and the App ID the how. The App ID required enrichment to resolve to "One Outlook Web." To get the user agent string (absent from the UAL event), he correlated via UTI to the non-interactive sign-in log, then via Correlation ID to the interactive sign-in log. This three-event chain enabled building a complete timeline: failed sign-in attempts, successful authentication, inbox rule creation, and subsequent actions (email deletion, forwarding, etc.).

Case Study 2: Azure Role Assignment. For an Azure roleAssignments/write event, Graeber identified that the Start event (not the Success event) contains the critical request body with the principal ID that the role was assigned to. The Success event lacks this information. The start event contained the caller identity, the role definition (Owner), the target subscription scope, the role assignment ID (needed for remediation), and the principal ID of the target. His subjective data quality assessment rated the Azure Activity start event as "medium to high" on its own, with correlation and enrichment able to fill remaining gaps (app name resolution, user agent string, sign-in event linkage).

Demo / Proof of Concept

▶ Watch: Case study: suspicious inbox rule creation with full correlation chain (26:00)

No live exploitation demo was performed. The talk demonstrated the methodology through worked examples using real log data, including Log Analytics queries showing the correlation from UAL events through non-interactive sign-in events to interactive sign-in events.

Defensive Implications

▶ Watch: Closing: repeatable process for assessing data quality across any vendor (40:00)

Detection engineers working with Microsoft cloud data should prioritize UTI-based correlation over Session ID or Correlation ID for high-fidelity event linking. The two-hop correlation pattern (UAL event -> non-interactive sign-in -> interactive sign-in) should be built into automated enrichment playbooks. For Azure role assignments, detection logic should key off start events rather than success events, since start events contain the request body with the principal and role definition.

Defenders should adopt the MVS template as a quality assurance check for every data source they depend on. If a data source cannot populate the who, what, when, where, whence, and how for a given technique, it should be flagged for enrichment requirements or vendor feedback. The absence of UTI in Entra ID Audit events should be raised with Microsoft as a feature request.

Key Takeaways

• Minimum Viable Storytelling provides a repeatable framework for assessing whether a log source has sufficient security context: who, what, when, where, whence, and how
• Unique Token Identifier (UTI) offers the highest-fidelity correlation in Microsoft logs; prefer it over Correlation ID and Session ID
• Correlating UAL events to interactive sign-in events requires a two-hop path through the non-interactive sign-in log
• Correlation ID is unreliable across most Microsoft products but does work between non-interactive and interactive sign-in logs
• For Azure role assignments, use start events (not success events) to capture the complete request context
• Entra ID Audit events lack UTI entirely, creating a significant correlation gap that Microsoft needs to address

About the Speaker(s)

Matt Graeber is a threat researcher at Red Canary with extensive industry experience. He co-coined the term "living off the land" at DerbyCon (with co-worker Chris Campbell) and has a long history in offensive security research before transitioning to threat research and detection engineering. He is known for deep analysis of Windows internals and Microsoft security tooling.