Sweet Deception: Designing Effective M365 Honey Tokens

Sweet Deception: Designing Effective M365 Honey Tokens

Speakers: Ryan O'Donnell, Senior Security Engineer, Microsoft

Conference: Cloud Village

YouTube: https://www.youtube.com/watch?v=JExFqn7aKNs

Overview

In an era where cyber attackers are increasingly shifting their focus from traditional endpoints to cloud environments, organizations face a growing challenge in detecting sophisticated, malware-free intrusions. Ryan O'Donnell, a Senior Security Engineer at Microsoft with a background in offensive security and digital forensics, presented "Sweet Deception: Designing Effective M365 Honey Tokens" at Cloud Village. His talk introduced a novel approach to early threat detection, specifically targeting post-compromise activity within Microsoft 365 environments using carefully crafted canary tokens.

O'Donnell's research highlights the paradigm shift in adversary tactics, where cloud intrusions are becoming prevalent and often bypass traditional endpoint detection and response (EDR) solutions. The core of his presentation revolved around defining the characteristics of an effective canary token and then demonstrating a practical, native implementation within M365. By leveraging existing Microsoft telemetry and subtle deception techniques, O'Donnell showcased how these tokens can act as high-fidelity tripwires, providing critical early alerts for both external compromises and internal threats.

The significance of this work lies in its potential to empower organizations, particularly small businesses without dedicated cybersecurity teams, to enhance their defensive posture against modern cloud-focused attacks. By making cyber deception methods more accessible and integrated into existing infrastructure, O'Donnell advocates for a strategic shift in how security teams approach detection and response in the cloud, moving beyond a "nice-to-have" to an architectural necessity.

Background

▶ Watch: Introduction and talk agenda for M365 honey tokens (0:00)

The cybersecurity landscape has undergone a significant transformation, with attackers increasingly abandoning traditional endpoint-focused campaigns in favor of cloud intrusions. This shift is largely attributed to the widespread adoption of Endpoint Detection and Response (EDR) solutions, which have made on-premise malware execution and persistence more challenging for adversaries. As highlighted by Florian Roth, this paradigm shift necessitates an evolution in defensive strategies. Supporting this observation, a recent CrowdStrike report indicated a staggering 136% increase in cloud intrusions in the first half of 2025 compared to all of 2024, with China Nexus adversary groups showing a 40% increase in activity. Crucially, 81% of these intrusions were malware-free, emphasizing the need for detection mechanisms that don't rely on signature-based or file-based indicators.

In response to this evolving threat, cyber deception methods offer a proactive and high-fidelity approach to detection. O'Donnell distinguishes between honeypots and honey tokens (or canary tokens). Honeypots are typically larger, decoy systems designed to attract attackers and gather threat intelligence through monitoring their interactions. They are often externally facing and occupy their own IP space. In contrast, honey tokens or canary tokens are more discrete pieces of data—such as API keys, credentials, or documents—strategically placed within an environment. Their primary function is to act as tripwires: any interaction with a canary token by an unauthorized entity triggers an alert, providing early warning of compromise. This talk focuses specifically on the latter, aiming to design and implement effective canary tokens within the Microsoft 365 ecosystem.

The core challenge in cloud environments, particularly M365, is the inherent noise in logging and the complexity introduced by different licensing tiers and service configurations. Traditional detection methods often struggle to identify subtle post-compromise activities amidst legitimate user behavior. Canary tokens, when designed correctly, can cut through this noise by generating alerts only when an adversary interacts with a deliberately placed decoy, offering a precise and actionable signal of malicious activity after initial access has been gained.

Key Findings

▶ Watch: Differentiating honeypots, honey tokens, and canary tokens (3:20)

O'Donnell's research began by establishing a rigorous set of criteria for what constitutes an effective canary token, particularly in the context of Microsoft 365. These principles guided the design and evaluation of his proposed solution:

1. Attractive: A canary token must be appealing to attackers, containing information or appearing in a context that would naturally draw their attention during post-compromise reconnaissance. If it's not interacted with, it serves no purpose.
2. High Fidelity: The token should generate alerts with very high confidence, minimizing false positives and avoiding alert fatigue. Unlike traditional Security Operations Center (SOC) alerts that often require significant manual intervention, a canary token alert should be a strong indicator of an actual security event.
3. Non-invasive: Deployment of canary tokens should not disrupt the operational environment or cause harm to legitimate systems. Furthermore, they should be designed to be invisible or inaccessible to regular users to prevent accidental interaction and reduce distraction.
4. Native: To facilitate widespread adoption and ease of management, an ideal canary token solution should leverage existing telemetry, licensing, and tools within the target environment, avoiding the need for additional third-party tools or complex integrations.

The primary finding of O'Donnell's work is the successful design and validation of an M365 canary token that largely meets these criteria. By combining hidden mailbox folders with strategic email content and monitoring the Unified Audit Log, he demonstrated a method for creating high-fidelity, native, and non-invasive tripwires. While the fidelity was not absolutely perfect (encountering a few initial baseline and one specific insider event), the overall results showed a significant number of days with zero false positives, validating the approach's effectiveness in early detection of both external compromise and potential insider threats. This practical demonstration highlights the feasibility of integrating sophisticated deception techniques directly into standard enterprise cloud environments.

Technical Deep Dive

▶ Watch: Key attributes for an effective M365 canary token (4:10)

The design of an effective M365 canary token hinges on understanding attacker motivations and leveraging native platform features. O'Donnell analyzed threat intelligence reports, such as those from Microsoft Threat Intelligence Center (MSTIC) on groups like Void Blizzard, and observations from Business Email Compromise (BEC) campaigns. These reports consistently show that post-compromise, attackers actively search user mailboxes, shared mailboxes, and SharePoint sites for sensitive information, including credentials, API keys, remote monitoring tools (e.g., AnyDesk), and financial data. This insight led to the determination that Exchange, Teams, and SharePoint are prime locations for deploying attractive canary tokens, with Outlook (Exchange) chosen for this research.

Traditional link-based canary tokens, often provided by services like Thinkst Canary, embed a unique link within an email or document. However, O'Donnell identified several drawbacks: links can be visible to legitimate users, increasing false positives; they introduce third-party dependencies; and sophisticated adversaries often evade them by expecting specific domains, using sandbox environments, or blocking unknown DNS resolutions, adding extra steps that reduce fidelity.

To overcome these, O'Donnell proposed utilizing hidden mailbox folders within Outlook. This property allows a folder to be created and hidden from the standard Outlook GUI. Crucially, emails placed inside a hidden folder remain searchable via Outlook's search function and through post-exploitation tools like GraphRunner. This ensures the token is attractive to an attacker performing reconnaissance but invisible to a casual user, preventing accidental interaction.

Creating a hidden folder involves using the Microsoft Graph API, where the hidden property must be set during folder creation. Once established, a canary email is crafted with specific keywords an attacker would likely search for but a legitimate user would not (e.g., "remote monitoring and management tools," "AnyDesk"). This email is then moved into the hidden folder.

Monitoring for access is achieved using the Unified Audit Log (UAL) in Microsoft 365, specifically the MailItemsAccessed operation. While this is a high-volume operation, O'Donnell's innovation lies in filtering these events by the unique Internet Message ID of the canary email. Any MailItemsAccessed event associated with this specific ID indicates a direct interaction with the token, providing a high-fidelity trigger for investigation.

The theoretical design process involves:

1. Creating a hidden folder via the Graph API.
2. Crafting a canary email with adversary-luring, user-unlikely keywords.
3. Moving the email into the hidden folder.
4. Continuously monitoring the UAL for MailItemsAccessed events filtered by the canary email's Internet Message ID.
5. Alerting upon detection for immediate investigation.

This approach significantly reduces false positives while maximizing detection likelihood during an adversary's post-compromise enumeration, establishing a robust and native deception mechanism.

Demo / Proof of Concept

▶ Watch: What M365 data attackers seek post-compromise (6:00)

To validate the theoretical design, Ryan O'Donnell deployed the M365 canary tokens in a real-world environment: a small, entirely cloud-native business with less than 50 employees, encompassing various functions like sales engineers and marketing. The deployment involved a subset of users, divided into two groups, for an initial four-week trial to observe MailItemsAccessed events for the canary emails, aiming for zero access events unless genuine suspicious activity occurred.

The results, visualized over the month, presented three phases:

1. Initial Deployment (Days 1-2): Expected access events occurred as O'Donnell created, sent, and moved emails into hidden folders, establishing a baseline.
2. Residual Syncing (Days 4 and 6): A single access event for each group was observed. These were attributed to initial syncing of mail items to other devices or services as the environment settled, deemed part of baseline establishment rather than malicious.
3. Significant Event (Day 13): A notable event occurred on day 13, distinct from surrounding zero-event days. Investigation revealed the user whose account triggered the alert had been terminated that week. While the overall volume of MailItemsAccessed events for that user wasn't drastically different, there was an increase during that time. O'Donnell hypothesized the user was reviewing or archiving emails prior to losing access, leading to an "errant hit" on the canary email. The application used was a Microsoft first-party application, but its specific application ID could not be resolved – a peculiar yet verified phenomenon where not all service principles are readily available.

Despite these initial events, the trial demonstrated a significant number of days with zero access events, validating the non-invasive and high-fidelity aspects. Evaluating against the criteria:

• Attractive: Outlook proved effective as a target.
• Non-invasive: Hidden folders successfully reduced accidental user interaction.
• Native: The solution exclusively leveraged the Unified Audit Log, requiring no additional tools or licensing.
• High Fidelity: While not perfectly zero-false-positive, alerts were generally clean. The day 13 event, though not an external compromise, provided valuable insight into potential insider threat activity, demonstrating an additional benefit for detecting anomalous user behavior. This validated the core premise that such tokens provide early, actionable alerts.

Defensive Implications

▶ Watch: Beginning to design an M365 canary token for Outlook (7:20)

The successful validation of M365 canary tokens by Ryan O'Donnell presents critical defensive implications for organizations facing modern cloud-centric threats. These tokens provide an effective early alerting mechanism for post-compromise activity within Microsoft 365 environments. Given the shift towards malware-free cloud intrusions, traditional EDR often falls short. By strategically placing these high-fidelity tripwires in common adversary targets like Exchange mailboxes, security teams gain immediate notification when an attacker begins enumeration or data exfiltration. This early warning drastically reduces adversary dwell time, enabling proactive response.

Beyond external threats, the research highlights the utility of canary tokens in detecting insider threats. The day 13 incident involving a terminated employee underscores this capability, providing a data point for anomalous behavior that could warrant investigation, particularly in sensitive shared mailboxes or SharePoint sites. This dual-purpose detection adds significant value.

The native integration with the Microsoft 365 Unified Audit Log is a game-changer, lowering the barrier to entry for sophisticated deception techniques. This is particularly beneficial for small businesses or organizations without dedicated cybersecurity teams, allowing them to leverage existing M365 telemetry for robust detection without additional overhead or cost.

O'Donnell advocates for a paradigm shift, urging organizations to integrate cyber deception methods earlier in the architectural phase of cloud environments, rather than as an afterthought. Embedding these tripwires from the outset builds a more resilient and proactive security posture, moving beyond reactive incident response.

In practice, defenders should:

• Identify critical data locations within their M365 tenant.
• Craft compelling canary content with adversary-luring, user-unlikely keywords.
• Deploy strategically using hidden mailbox folders or similar native hiding mechanisms.
• Automate monitoring and alerting based on MailItemsAccessed events filtered by the canary token's unique ID, integrating with existing SIEM/SOAR platforms.
• Regularly review and tune tokens to maintain high fidelity and adapt to evolving threats.

By embracing these principles, organizations can transform their M365 environment into a highly sensitive detection grid, significantly improving their ability to identify and mitigate advanced cloud-based threats.

Key Takeaways

• The cybersecurity threat landscape has shifted dramatically to cloud environments, with 81% of observed intrusions being malware-free, necessitating new detection strategies beyond traditional EDR.
• M365 canary tokens offer high-fidelity early alerting for post-compromise activity by acting as tripwires that signal malicious enumeration or access attempts.
• Effective canary tokens must be attractive to attackers, non-invasive to users, high-fidelity in their alerts, and native to the existing cloud platform's telemetry.
• Hidden mailbox folders in M365, combined with specific email keywords and monitoring of the Unified Audit Log's MailItemsAccessed operation, provide a robust, native, and low-friction deception mechanism.
• Canary tokens are valuable for detecting both external adversary compromise and internal threat activity, as demonstrated by the case of the terminated employee.
• Integrating cyber deception methods like canary tokens into cloud architecture from the outset, rather than as an afterthought, is crucial for enhancing detection and response capabilities for organizations of all sizes.

About the Speaker(s)

Ryan O'Donnell is a Senior Security Engineer at Microsoft. His professional experience spans both offensive and defensive security domains. He has focused extensively on offensive security, engaging in penetration testing, red teaming, and purple teaming exercises. Prior to his work in offensive security, O'Donnell also gained significant experience in digital forensics. This diverse background provides him with a unique perspective on understanding adversary tactics and developing effective defensive countermeasures, particularly in the evolving landscape of cloud security. His research presented at Cloud Village highlights his commitment to exploring innovative solutions for detecting sophisticated threats in Microsoft 365 environments.