Attack Chain

1. Initial access is achieved through an unknown method (e.g., phishing, credential stuffing, or malware).
2. The attacker successfully authenticates to a user account within the Entra ID environment.
3. Entra ID Protection detects suspicious activity based on configured risk detections.
4. An administrator reviews the risk detection within the Entra ID Protection portal.
5. The administrator confirms the user or sign-in as compromised based on the evidence.
6. The compromised account may be used for lateral movement within the organization's cloud resources.
7. The attacker may attempt to escalate privileges or access sensitive data.
8. The ultimate objective may be data exfiltration, disruption of services, or other malicious activities.

Impact

A successful compromise of an Entra ID account can lead to significant damage, including unauthorized access to sensitive data, lateral movement within the organization's cloud infrastructure, privilege escalation, and potential data exfiltration. The impact depends on the privileges and access rights of the compromised account, potentially affecting all resources and applications accessible to that user. If successful, an attacker can gain a foothold in the cloud environment, leading to data breaches, financial loss, and reputational damage.

Recommendation

• Enable and monitor Microsoft Entra ID Protection logs to detect confirmed compromised accounts (Required Microsoft Entra ID Protection Logs).
• Deploy the Sigma rule "Entra ID Protection Admin Confirmed Compromise" to your SIEM to detect confirmed compromised accounts and sign-ins. Tune the rule based on your environment's specific configurations (Sigma rule).
• Upon detection, immediately reset the password and revoke active sessions for the compromised user account as part of your incident response plan (note).
• Investigate the Azure logs for the affected user account to determine the initial access method and any subsequent malicious activity (azure.identityprotection.properties.*).