phishing attacks and exploits

>I'd yank the entire address book
would exchange/office365 capture yanking of the address book though? Or could they be done discretely with access.

'Then at least one of the following' - I assume this would all be automated not manual process by whoever got the compromised credentials, and typically sophisticated enough to leave little traces of what they did do.

Azure logs would have at least some information to assist. But count on them covering their tracks.

>Azure logs would have at least some information to assist

would they just be connections though rather than specific actions?

>But count on them covering their tracks.

what kind of techniques would they use to cover their tracks if theyd only compromised a standard user acct.

>What kind of techniques? Normally, things so you couldn't discover what they sent, such as removing sent and deleted items

>During this reconnaissance phase of an attack, cybercriminals will even set up new mailbox rules to hide or delete those emails they have sent from the compromised account.

thank you for your input, but would they really be able to wipe/hide entries from central message trace logs if all they compromised was a standard user account, I assume an admin could, but not a standard user. The downloading of the mailbox makes some sense though to avoid detection and forwarding of emails which are more likely to leave a trace. .Just interested technically how they would do such a thing with standard user privileges.

If it is not insider doing, the audit trails would have surfaced and the details can be articulated in the recordtype and more, just make sure it is not been overridden and still there..

https://docs.microsoft.com/en-gb/microsoft-365/compliance/detailed-properties-in-the-office-365-audit-log

But many a time, either auditing is not enabled or modified due to upgrade or misconfigured etc, the short it is not foolproof. 

As you mention, the technicalities is of interest and you can find it in the below.

The release of a security research tool called Ruler enables an attacker to install a persistence mechanism once an account has been breached to maintain access even through a password roll.

https://docs.microsoft.com/en-gb/archive/blogs/office365security/defending-against-rules-and-forms-injection

Another is via such interface. Key is even user mode is good enough to do very stealthy stuff.

The Microsoft Messaging Application Programming Interface (MAPI), is “… a set of functions that mail-enabled and mail-aware applications use to create, manipulate, transfer, and store mail messages….”. Furthermore, according to Microsoft “… MAPI also provides a common interface that application developers can use to create mail-enabled and mail-aware applications independent of the underlying messaging system.”