The log that caught Storm-0558 was a paid extra
Attackers read government email using forged Microsoft tokens. It was spotted thanks to a premium log most customers didn’t have.
This month Microsoft said a China-based group it calls Storm-0558 forged authentication tokens and read email at about 25 organisations, including government agencies. The interesting part is how it was found: a US agency noticed unusual mail access in its audit logs.
That log, which records which mail items were accessed, was only available in Microsoft’s premium audit tier. Most customers couldn’t have seen the same thing. After criticism, Microsoft said it will make more of these logs available on standard plans.
The lesson goes beyond Microsoft:
- Check which audit logs your cloud services actually keep on your plan, and for how long. Some are off by default.
- Turn on what’s free. Then decide if the paid tiers are worth it for your most sensitive mailboxes.
- Send logs to your own storage so they outlive the provider’s retention.
- Know what “normal” looks like for key accounts, so “unusual” stands out.
When something goes wrong in the cloud, the logs are often all you have. Find out now what you’d be missing.