https://feed.craftedsignal.io/tags/identity-threat/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 02 Nov 2026 15:08:37 +0000https://feed.craftedsignal.io/favicon-32x32.pnghttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svghttps://feed.craftedsignal.io/briefs/2026-11-entra-id-graph-enumeration/Mon, 02 Nov 2026 15:08:37 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-entra-id-graph-enumeration/Identification of a pattern where a non-interactive Microsoft Entra ID client sign-in, characterized by managed device context and an Edge user agent, is followed by the use of the same access token by a scripted client to perform directory enumeration via Microsoft Graph.<p>This threat brief describes a detection pattern for unauthorized Microsoft Graph API usage. It correlates non-interactive Microsoft Entra ID sign-ins (asserting managed, Azure AD joined device context and an Edge user agent) with subsequent activity where the exact access token is used by a scripted client to query at least three distinct directory-enumeration paths in Microsoft Graph. This approach utilizes the unique token identifier to correlate activity, rather than relying on session identifiers.</p> mediumadvisorycloud-securityidentity-threatprivilege-escalationpersistence