@fifonetworks@infosec.exchange important to look for apps, too. on compromised office365 accounts hackers often install them for persistence!