Lessons from 2024 Breaches: Audit Logs as the Unsung Hero in Cyber Defense

Cyberattacks are getting smarter, but so are the tools to detect them. The 2024 Storm-0558 breach, which targeted 25 organizations, proved one thing: audit logs can catch what traditional defenses miss.

Key Takeaways for Cybersecurity Teams:

• Spot Hidden Threats: Manual analysis of logs uncovered irregular email access during the Storm-0558 attack. Automated tools missed it.

• Understand Baselines: Knowing "normal" activity makes it easier to detect anomalies.

• Use Advanced Logging Tools: Microsoft 365 Purview Audit Premium offers deeper insights into unusual behaviors.

Quick Wins for Better Security:

• Activate detailed logging in systems like Microsoft 365.

• Regularly monitor events like

  MailItemsAccessed

  for unusual patterns.

• Use centralized log platforms like LogCentral for faster analysis.

Why It Matters:

Audit logs don’t just help with compliance; they’re a powerful tool for spotting breaches early, protecting data, and responding faster. Start using logs to stay ahead of attackers.

Storm-0558 Attack: Learning from Microsoft's Breach

The Storm-0558 attack stands out as a highly advanced breach that bypassed traditional security defenses but was ultimately uncovered through meticulous audit log analysis. This case highlights just how crucial logging is for maintaining cybersecurity.

Timeline of the Storm-0558 Attack

On 15 May 2023, a threat actor linked to China infiltrated the email systems of approximately 25 organizations, including government agencies. Operating during standard Asian business hours (08h00–17h00 CST), the attackers used a series of highly advanced techniques to execute the breach [1].

Here’s how they did it:

• Exploited an inactive Microsoft signing key.

• Took advantage of a validation error in Microsoft’s code.

• Forged authentication tokens for Azure AD enterprise and MSA consumer accounts.

• Used PowerShell and Python scripts to access Exchange Online via OWA.

To remain undetected, the attackers relied on dedicated infrastructure, including the use of SoftEther proxy software [1].

Detecting the Attack Through Log Analysis

In mid-June 2023, the security team of an FCEB agency spotted unusual patterns in Microsoft 365 audit logs [2]. Specifically, they noticed irregular

MailItemsAccessed

events with unexpected

ClientAppID

and

AppID

values - details that stood out against the organization’s usual activity baseline [2].

"The

MailItemsAccessed

event enables detection of otherwise difficult to detect adversarial activity." - CISA and FBI [2]

This discovery underscores the importance of robust log analysis in identifying and mitigating advanced threats.

Key Takeaways for IT Teams

1. Strengthen Logging Practices

-   Activate Purview Audit (Premium) logging.
    
-   Use Microsoft 365 Unified Audit Logging (UAL).
    
-   Ensure logs are fully integrated and searchable within SOC platforms.
    

2. Establish Baseline Activity

-   Regularly document typical Outlook activity and expected `AppID` values.
    
-   Update baselines to account for changes in cloud environments, enabling faster detection of anomalies.
    

3. Prioritize Proactive Monitoring

-   Implement automated tools to flag anomalies.
    
-   Conduct routine reviews of audit logs.
    
-   Maintain consistent visibility across all critical systems.
    

The Storm-0558 breach serves as a reminder: even the most skilled attackers leave traces. While they managed to bypass preventive measures, their actions were ultimately uncovered through diligent log analysis - a testament to the power of thorough monitoring.

Using Audit Logs for Security Monitoring

Keeping a close eye on audit logs can be a game-changer for identifying and responding to security threats. Time and time again, incidents have shown that well-managed logs are the difference between catching an issue quickly and leaving vulnerabilities open for too long.

Which Logs Need Monitoring

Not all logs are created equal, and security teams should focus on those most likely to expose potential threats. Based on real-world cases, here are the key log types and what to watch for:

By focusing on these areas, you can zero in on potential vulnerabilities and take action before they escalate.

Log Analysis Methods and Tools

Combining smart tools with human expertise is the key to effective log analysis. Following the guidance of CISA, organisations can adopt the following strategies:

1. Baseline Activity Monitoring

Establish a clear understanding of normal system behavior, such as typical AppID values and access patterns. This makes it easier to spot anything out of the ordinary.

2. Centralised Log Management

Use a centralised system like a Security Information and Event Management (SIEM) platform to gather logs from various sources, including:

• Cloud services and platforms

• Security tools

• Endpoint solutions

• Secure cloud access (SCA) systems

3. Automated Alert Configuration

Set up alerts for suspicious activities, such as:

• Unusual ClientAppID and AppID combinations in Microsoft 365

• Login attempts from unexpected geographic locations

• Access to sensitive data during non-business hours

These methods help streamline detection and response, reducing the time it takes to address potential threats.

Meeting GDPR Log Requirements

Good log management isn’t just about security - it’s also a legal necessity. The GDPR’s Article 32 outlines specific logging requirements, including:

• Keeping security-related logs for at least 12 months

• Ensuring logs remain intact and confidential

• Regularly reviewing logs for potential issues

• Documenting log management practices

"Critical infrastructure organisations are strongly urged to implement the logging recommendations in this advisory to enhance their cybersecurity posture and position themselves to detect similar malicious activity." – CISA and FBI [2]

For organisations in need of a GDPR-compliant solution, LogCentral provides features like native multi-tenancy, long-term retention, automated compliance reporting, and role-based access controls (RBAC).

LogCentral: Advanced Log Management Platform

LogCentral is a European log management solution designed to deliver top-tier security monitoring while meeting strict GDPR compliance standards. Drawing from lessons learned in recent cybersecurity breaches, it provides the technical capabilities needed to tackle today’s security challenges.

Core Features of LogCentral

LogCentral offers three key functionalities that make it stand out:

Real-Time Security Monitoring
The platform processes thousangs per second with a latency of under 50 milliseconds.

Data Sovereignty Compliance
LogCentral ensures compliance with EU data protection regulations by hosting its services in data centres located in France and Germany. It employs a combination of advanced security measures, including:

• AES-256 encryption for data storage

• TLS 1.3 encryption for secure data transmission

• Field-level encryption for sensitive information

• WORM (Write Once, Read Many) storage for audit trails [4]

How LogCentral Stands Out

LogCentral’s features place it ahead of other log management platforms in the market. Here’s a quick comparison:

Streamlining LogCentral Setup

LogCentral’s integration process is designed to be straightforward and efficient.

Cisco Meraki Integration Steps
For Cisco Meraki, the setup involves three main stages:

• Initial Configuration
  Generate API credentials in the Meraki dashboard, set up syslog forwarding, and configure the LogCentral endpoint [5].

• Optimising Log Collection
  Enable Security Event logging, configure Flow logs, and create custom filtering rules [4].

• Establishing Monitoring
  Define baseline patterns, set alert thresholds, and configure role-based access controls (RBAC) [4].

Conclusion: Strengthening Security with Audit Logs

The Role of Audit Logs in Cybersecurity

Audit logs are a cornerstone of modern cybersecurity. They don't just tick compliance boxes - they’re powerful tools for uncovering breaches that might slip past traditional defenses. Beyond compliance, these logs play a vital role in identifying threats and improving response times. In fact, French organizations that embrace comprehensive log management often detect threats faster and manage incidents more effectively.

To help you optimize your log management approach, here’s a practical checklist.

Key Steps for Effective Log Management

• Comprehensive Log Collection
  Ensure all critical systems are covered:

  • Activate Microsoft 365 Unified Audit Logging.

  • Add Purview Audit Premium for deeper insights.

  • Configure logging across all essential systems.

• Storage and Retention Practices

  • Retain logs in active storage for 12 months.

  • Archive logs for an additional 18 months in cold storage.

  • Choose EU-based data centres to meet GDPR requirements.

• Monitoring and Analysis

  • Establish baseline activity patterns for normal operations.

  • Implement real-time monitoring tools.

  • Set automated alerts to flag unusual or suspicious activity.

FAQs

::: faq

How can businesses leverage audit logs to uncover cyber threats that traditional security tools might overlook?

Businesses can strengthen their defenses against cyber threats by making smart use of audit logs. These logs should be detailed, consistently monitored, and reviewed regularly to uncover potential risks. Take the Storm-0558 breach in mid-2023 as an example. Attackers exploited zero-day vulnerabilities to infiltrate sensitive systems. While their activity was subtle, traces were left behind in the audit logs - specifically, unusual

MailItemsAccessed

events in Microsoft 365. Interestingly, it wasn’t automated tools that flagged these anomalies but a vigilant customer, proving how critical human oversight can be.

To detect threats early, organizations should pay close attention to specific log events, such as administrator actions, access to sensitive data, or unusual login patterns. Setting up alerts for suspicious activity and conducting regular log audits can give businesses an edge, even when traditional security measures fall short. :::

::: faq

How can IT teams define a baseline for normal activity to improve anomaly detection?

To enhance anomaly detection, IT teams should begin by establishing a clear baseline of what constitutes normal activity within their systems. This means closely examining typical user behaviours, access patterns, and traffic flows across both cloud-based and on-premises environments. Once you have a solid understanding of "normal", it becomes much easier to spot anything out of the ordinary.

Pay special attention to key metrics like login frequency, data access trends, and administrator actions. Make it a habit to regularly review and adjust this baseline to ensure it keeps up with changes as your organisation grows or evolves. Staying proactive with logging and analysis can greatly improve your team’s ability to catch and address potential threats before they escalate. :::

::: faq

Why should businesses use centralized log management platforms like LogCentral to monitor audit logs for better cybersecurity?

Centralized log management platforms, like LogCentral, are essential tools for bolstering cybersecurity. By gathering and analyzing audit logs from multiple systems in one place, these platforms make it easier to spot anomalies and potential threats - especially those that might slip past traditional security measures. A real-world example of their importance is the Storm-0558 breach, where unusual activity in Microsoft 365 audit logs, noticed by an attentive user, helped uncover a sophisticated state-sponsored attack.

Integrating audit logs into a centralized system offers several advantages:

• Faster threat detection: Spot unusual patterns such as unauthorized access to sensitive data or irregular admin activities.

• Simplified investigations: With all log data in one place, incident responses become quicker and more efficient.

• Regulatory compliance: Maintain comprehensive records that meet cybersecurity requirements.

For small and medium-sized businesses (SMBs), adopting this approach not only enhances security but also delivers actionable insights to manage risks more effectively. :::