MAGIC Tricks for Microsoft 365 Incident Response: Hands-on AiTM Phishing and Business Email Compromise Investigations#

Sven Ulke, Alexander Gödeke, Martin Glück (incident response team, SVA-Cybersecurity)

• Why: BEC investigations are now identity-breach investigations: stolen session cookies, OAuth grant abuse, inbox-rule persistence. This gives you the concrete evidence model for what an AiTM compromise looks like in a cloud IdP's telemetry.
• What: MAGIC (Microsoft Azure Graph Information Crawler), an open-source Python toolset collecting IR-relevant M365 data via Microsoft Graph, plus a 2-hour hands-on training around a realistic BEC scenario: which evidence matters (sign-ins, message traces, mailbox artifacts, conditional access events, OAuth grants, inbox rules/forwarding), and how to build a defensible investigation timeline in Timesketch/OpenSearch.
• How: Structured Graph API collection replacing ad-hoc calls and spreadsheet forensics; timeline reasoning across sign-in, mailbox, and enrichment data.
• Where applicable: M365 tenants and the IR/SOC teams that support them. Tool and workshop dataset are on GitHub, so it's reproducible outside the conference. (from abstract only)