Tag
CVE-2026-33843 Authentication Bypass in Microsoft Azure Active Directory B2C
2 rules 1 TTP 1 CVECVE-2026-33843 allows an unauthorized attacker to elevate privileges over a network in Microsoft Azure Active Directory B2C due to an authentication bypass using an alternate path or channel.
EntraFalcon Security Posture Assessment Tool
2 rules 3 TTPs 2 IOCsEntraFalcon is a security tool designed to enumerate and assess the security posture of Entra ID tenants, identifying misconfigurations and vulnerabilities related to users, groups, applications, roles, PIM settings, and Conditional Access policies.
Detection of ConvertTo-AADIntBackdoor Execution via PowerShell
2 rules 4 TTPsThis brief outlines the detection of the ConvertTo-AADIntBackdoor command execution via PowerShell Script Block Logging, a technique used to create a backdoor in federated Azure AD domains by modifying federation settings and allowing attackers to control the authentication process.
O365 Email Access By Security Administrator
2 rules 2 TTPsAtypical access to O365 mailboxes is detected when a security administrator uses Threat Explorer features to directly view email, potentially indicating reconnaissance or data exfiltration by a compromised or malicious insider.
Azure AD Service Principal Privilege Escalation
2 rules 1 TTPAn Azure Active Directory (Azure AD) Service Principal elevates its own privileges by adding itself to a new application role assignment, potentially leading to unauthorized access and control within the Azure environment.