{
  "source_id": "ms-storm-2949-cloud-breach-2026",
  "source_key": "ms-storm-2949-cloud-breach-2026",
  "title": "How Storm-2949 turned a compromised identity into a cloud-wide breach",
  "publisher": "Microsoft Defender Security Research Team",
  "source_url": "https://www.microsoft.com/en-us/security/blog/2026/05/18/storm-2949-turned-compromised-identity-into-cloud-wide-breach/",
  "originally_published": "2026-05-18T22:42:50+00:00",
  "most_recently_updated": "2026-05-18T22:42:53+00:00",
  "first_collected": "2026-10-22T19:50:55+00:00",
  "last_successfully_checked": "2026-10-22T19:50:55+00:00",
  "original_content_digest": "2c8730c0d46ea75d11efae8fc27e5c860f6919918ac51874ecb55e7eaf68369b",
  "source_publication_date": "2026-05-18",
  "date_precision": "timestamp",
  "affected_platform": "Microsoft Entra ID / Microsoft 365 / Azure / Windows",
  "date_note": "Historical original-publisher report. Full publication or update timestamps remain unknown where only a date is supplied. Google published_time metadata may reflect migration and is not promoted to an original publication or update timestamp.",
  "review_decision": "include",
  "reason_codes": [
    "editor-approved",
    "The original investigation explicitly describes removal of local forensic artifacts and states that the actions complicate investigation. This is direct evidentiary impact rather than a generic intrusion or CVE item."
  ],
  "editorial_annotation": "Microsoft reports cleanup of local forensic artifacts in a cloud-to-endpoint intrusion. Preserve the distinction between endpoint history and cloud audit coverage, and trace credential context through the available identity records before naming a person.",
  "topic": "Cloud and endpoint traces",
  "evidence_quote_reference": {
    "short_quote": "clearing Windows event logs",
    "section": "Reviewed original report; locate the quoted phrase in context."
  },
  "editor_reviewed": "2026-10-22",
  "historical": true,
  "related_guide_urls": [
    "https://anti-forensics.com/reference/artifacts/windows-event-forwarding-gaps/",
    "https://anti-forensics.com/reference/artifacts/cloud-audit-scope-and-identity/",
    "https://anti-forensics.com/reference/field-guides/collection-provenance-record/"
  ],
  "record_version_digest": "6d987f7c97f72659e595f8b258e5580f0e35f019beaa8165afc0b590ac5f83f7"
}