Tag
Microsoft Entra ID Temporary Access Pass (TAP) Abuse for MFA Bypass and Persistence
3 rules 2 TTPsAn attacker with elevated privileges abuses the Microsoft Entra ID Temporary Access Pass (TAP) feature to bypass multi-factor authentication (MFA), gain unauthorized access to target user accounts, and establish persistence by registering new authentication methods.
M365 or Entra ID Identity Sign-in from a Suspicious Source
2 rules 1 TTPThis rule correlates Entra-ID or Microsoft 365 mail successful sign-in events with network security alerts by source address, indicating potential initial access via compromised credentials.
Entra ID OAuth User Impersonation to Microsoft Graph
2 rules 2 TTPsThis rule detects potential session hijacking or token replay in Microsoft Entra ID, identifying cases where a user signs in and subsequently accesses Microsoft Graph from a different IP address using the same session ID, which may indicate a successful OAuth phishing attack, session hijacking, or token replay attack.
Detect Windows Entra User Management Via Azure CLI
2 rules 3 TTPsThis analytic detects the usage of the Azure CLI to interact with user accounts, such as creating or deleting a user, potentially indicating malicious activity aimed at maintaining persistence and evading detection within an Entra ID environment.