From Lure to Alert: Implementing Canary Tokens in M365 | Ryan O'Donnell

## Overview Ryan O'Donnell describes piloting mailbox-based canary tokens in Microsoft 365 using native audit telemetry rather than third-party tripwires.

## Motivation and Threat Model After initial cloud compromise, actors like Storm 2372 run crude keyword searches—"password," "admin," credentials—across stolen mailboxes. O'Donnell targets this predictable post-compromise behavior to shrink dwell time below industry medians.

## Implementation Details Lure emails are planted in hidden folders such as Recoverable Items, which remain searchable even when not visible in the UI. Testing with Graphrunner confirmed keyword searches surface canary content. Day 12 of the first pilot produced an alert at 11:47 p.m. based solely on mailbox operations—no EDR or malware signals.

## Takeaways M365-native canary tokens can detect intruder mailbox reconnaissance early, but require careful lure placement, tuning, and validation that hidden folders remain indexed.