Product
Microsoft Security Updates — July 2026
10 CVEs 227 IOCsRoundup of Microsoft security advisories published in July 2026.
Webworm APT Updates TTPs with Discord and Microsoft Graph C2
2 rules 10 TTPs 1 CVE 1 IOCThe Webworm APT group is using updated tactics, techniques, and procedures, including new backdoors using Discord and Microsoft Graph API for command and control, custom proxy tools, and GitHub for malware staging, shifting focus to European governmental organizations.
Microsoft Graph API Email Access by Unusual Client and User
2 rules 1 TTPDetects anomalous access to email resources via Microsoft Graph API, potentially indicating a compromised OAuth refresh token or Primary Refresh Token (PRT) being used by an attacker.
Azure AD Service Principal Enumeration via Microsoft Graph API
2 rules 2 TTPsAn attacker uses Microsoft Graph API to enumerate multiple Azure AD service principals, potentially using tools like AzureHound or ROADtools, to gather information for privilege escalation or lateral movement.
O365 Service Principal Creation Detection
2 rules 1 TTPDetection of new service principal creation in O365 tenants, which can be abused by attackers for unauthorized access, API interaction, and data compromise.
Unusual Microsoft Graph Email Access via OAuth Application
2 rules 2 TTPsAn adversary might use a phished OAuth refresh token or Primary Refresh Token (PRT) with a first-party application to access email resources via Microsoft Graph API, particularly focusing on unusual application and user combinations.
Microsoft Graph API Request User Impersonation by Unusual Client
2 rules 2 TTPsDetection of the first-time use of a Microsoft Graph API request by a specific client application ID, user principal object ID, and tenant ID, potentially indicating unauthorized access via phishing, token theft, or OAuth abuse.