APT29 has disabled Purview Audit on targeted accounts prior to stealing emails from  Microsoft 365 tenants.(Citation: Mandiant APT29 Microsoft 365 2022)|
|mitre-attack|enterprise-attack|IaaS,Azure AD,Office 365,SaaS,Google Workspace|T1059.009|Cloud API|

APT29 has leveraged the Microsoft Graph API to perform various actions across Azure and M365 environments. They have also utilized AADInternals PowerShell Modules to access the API (Citation: MSTIC Nobelium Toolset May 2021)|
|mitre-attack|enterprise-attack|IaaS,Azure AD|T1651|Cloud Administration Command|

APT29 has used Azure Run Command and Azure Admin-on-Behalf-of (AOBO) to execute code on virtual machines.(Citation: MSTIC Nobelium Oct 2021)|
|mitre-attack|enterprise-attack|Office 365,Azure AD,SaaS,IaaS,Google Workspace|T1021.007|Cloud Services|

APT29 has leveraged compromised high-privileged on-premises accounts synced to Office 365 to move laterally into a cloud environment, including through the use of Azure AD PowerShell.(Citation: Mandiant Remediation and Hardening Strategies for Microsoft 365)|
|mitre-attack|enterprise-attack|Windows,Azure AD,SaaS,Google Workspace,Office 365,IaaS|T1556.007|Hybrid Identity|

APT29 has edited the

APT29 has abused misconfigured AD CS certificate templates to impersonate admin users and create additional authentication certificates.(Citation: Mandiant APT29 Trello)|
|mitre-attack|enterprise-attack|Windows,Office 365,Linux,macOS,IaaS,SaaS,Azure AD,Google Workspace|T1621|Multi-Factor Authentication Request Generation|

APT29 has used repeated MFA requests to gain access to victim accounts.(Citation: Suspected Russian Activity Targeting Government and Business Entities Around the Globe)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1027.006|HTML Smuggling|