Huntress Launches Microsoft 365 Lookback to Find and Respond to Pre-Onboarding Compromises

Summary

Huntress’s Lookback feature reviews up to 180 days of Microsoft 365 login history during onboarding. It separates resolved findings from active compromises, which its SOC investigates and responds to by revoking active sessions.

Key points

Lookback runs automatically when a Microsoft 365 tenant onboards to Huntress Managed ITDR and reviews up to 180 days of available login history.
Its detections cover credential and token theft, adversary-in-the-middle attacks, suspicious browsers, and datacenter logins.
Historical findings assessed as active trigger a critical Incident Report and SOC investigation; Huntress says it revokes the identity’s active sessions.
Previously remediated compromises appear as historical context in the Identity Security Assessment and do not trigger a new incident.
In its first two weeks of early testing, Huntress says it reviewed more than 400 tenants and found active compromises at three organizations.
The examples included a device-code phishing attack targeting a $2 million real estate wire, a compromised school district Global Admin account, and an architecture firm account used to send 103 external OneDrive phishing invitations. Huntress says it contained all three compromises.

Article Details

Event Type: General availability launch of Huntress Managed ITDR's Lookback feature for newly onboarded Microsoft 365 tenants.
Impact: Lookback reviews up to 180 days of Microsoft 365 login history to identify prior compromises. Huntress reports that active compromises receive SOC investigation and containment, including revocation of active sessions; previously remediated compromises are documented as historical context. In early testing, Huntress reviewed more than 400 tenants and described three active compromises it surfaced, including one involving a $2 million wire transfer, one involving a compromised school-district Global Admin account, and one involving phishing invitations sent from a compromised architecture-firm account.

Vendors

HuntressToday, Huntress Managed ITDR's Lookback feature is generally available for newly onboarded Microsoft 365 tenants. Lookback automatically examines up to 180 days of login history to uncover evidence of compromise before

Products

Azure ADAdmin account had been compromised 27 days before onboarding. An unrevoked refresh token and a rogue Azure AD device kept the attacker's access alive, with the privileges to control the tenant. Lookback uncovered Entragave an adversary access three days before the tenant onboarded. The attacker persisted through a rogue Entra device and was watching a $2 million real estate wire transfer. Lookback surfaced the active compromise,Managed ITDRToday, Huntress Managed ITDR's Lookback feature is generally available for newly onboarded Microsoft 365 tenants. Lookback automatically examines up to 180 days of login history to uncover evidence of compromise before Microsoft 365 Apps for EnterpriseHomeBlogIntroducing ITDR Lookback: Find Out Who Was in Your Microsoft 365 Tenant Before You Were Microsoft OneDrivewith a nine-day foothold still active. The attack involved a hidden inbox rule and 103 external OneDrive phishing invitations sent in a single scripted second. The compromised account had become infrastructure

Industries

ArchitectureAn architecture firm turned into a phishing launchpad real estatetenant onboarded. The attacker persisted through a rogue Entra device and was watching a $2 million real estate wire transfer. Lookback surfaced the active compromise, which Huntress contained.