Tag
O365 Admin Consent Bypassed by Service Principal
2 rules 2 TTPsA service principal in Office 365 Azure Active Directory assigns app roles without standard admin consent, potentially bypassing critical administrative controls and leading to unauthorized access or privilege escalation.
Azure AD Service Principal Enumeration via Microsoft Graph API
2 rules 2 TTPsAn attacker uses Microsoft Graph API to enumerate multiple Azure AD service principals, potentially using tools like AzureHound or ROADtools, to gather information for privilege escalation or lateral movement.
Detect Application AppID URI Configuration Changes in Azure
2 rules 2 TTPsDetection of configuration changes to an application's AppID URI in Azure, potentially indicating malicious activity related to initial access, persistence, credential access, privilege escalation, or stealth.
Azure AD Service Principal Authentication Monitoring
2 rules 1 TTPThis analytic identifies authentication events of service principals in Azure Active Directory, monitoring sign-in frequency, timing, source IPs, and accessed resources to detect potential anomalies indicative of compromised credentials or malicious activities.