Next to add

[randomaccess3]

https://github.com/evild3ad/Microsoft-Analyzer-Suite
https://apptotal.io/
https://github.com/randomaccess3/detections/blob/main/M365_Oauth_Apps%2FMaliciousOauthAppDetections.json

[randomaccess3]

https://github.com/RedByte1337/GraphSpy

[randomaccess3]

https://github.com/evild3ad/Microsoft-Analyzer-Suite

[randomaccess3]

https://github.com/PuravsPoint/DecipheringUAL

[randomaccess3]

https://cyberdom.blog/2024/04/26/microsoft-365-cloud-investigation-via-unified-audit-log-insights-and-tips/

[randomaccess3]

https://www.kroll.com/en/insights/publications/cyber/enterprise-applications-in-m365-to-exfiltrate-data

[randomaccess3]

https://www.lieben.nu/liebensraum/2024/12/m365permissions-v1-0-8/

[randomaccess3]

https://medium.com/@securityaura/microsoft-unified-audit-log-ual-what-you-come-to-learn-the-hard-way-905a087a1558?source=rss-8b1f55b0ed95------2

[randomaccess3]

https://www.invictus-ir.com/news/forensic-analysis-of-em-client