The DEF CON 34 workshop material is up

The workshop is done, and the complete set of materials from "Investigating and Responding to M365 account compromise on a shoestring: Living off the Land Incident Response" has now been uploaded to GitHub. Everything I walked through in the room - and quite a bit more that we didn't have time for - is in the repo for you to work through at your own pace.

Grab it all here.

What's in there:

• The full slide deck (v1.3), cleaned up and with a few post-workshop corrections.
• Two handouts - one covering the script-based collection approach, and one covering native/manual collection for when you can't run anything extra in the tenant.
• Six complete example incident scenarios, each with the raw log collection, the processed/flattened log files, tenant settings notes, and a full matching set of finished reports (one-pager, investigation report, attestation letter, and internal post-mortem) so you can see a case from raw logs all the way through to deliverables.
• The report templates themselves, so you can produce the same deliverables for your own incidents.
• An LLM-related section, including a couple of skills for assisting with M365 BEC investigation and report writing.

It's built to be worked through hands-on. You can pull the scenario log collections, run them through analysis, and compare your findings and write-ups against the included reports.

And a few small M365 IR script updates

While I was at it I pushed a handful of small updates to the M365IRScripts collection.

Nothing dramatic this round, just refinement:

• Tidier module update and connection handling (00-Update-M365Modules.ps1 and 01-Connect-M365Modules.ps1), with reduced permission scope requests and read-only options where they make sense.
• A reworked mailbox message search script (45-Search-MailboxMessage.ps1) that is no longer experimental - ready for use in manual message retrieval by internet message ID.
• Small fixes to the IP info lookup (06-Lookup-IPInfoCSV.ps1) and the mailbox audit log collector (34-Get-MailboxAuditLog.ps1), plus general error-handling and input-validation cleanup.

These scripts and example log collections are aimed at SMB/SME incident response where you don't have Sentinel or another SIEM to lean on, and the workflow only needs appropriate tenant access and a few PowerShell modules. The ReadMe has the overview of the process.

And if you're doing manual CSV log review, this collection of Excel/Calc macros is still the best way I know to slice, sort, and review those exports by hand.

Thanks to everyone who came out to the workshop. Feel free to reach out with any feedback or questions.

Walk on,

 \`._,'/
 (_- -_)
   \o/