Data Source: Microsoft Entra ID Audit Logs | Detection.FYI

Microsoft Entra ID Illicit Consent Grant via Registered Application

Mar 27, 2025 · Domain: Cloud Data Source: Azure Data Source: Microsoft Entra ID Data Source: Microsoft Entra ID Audit Logs Use Case: Identity and Access Audit Resources: Investigation Guide Tactic: Initial Access Tactic: Credential Access ·
Share on:

Identifies an illicit consent grant request on-behalf-of a registered Entra ID application. Adversaries may create and register an application in Microsoft Entra ID for the purpose of requesting user consent to access resources. This is accomplished by tricking a user into granting consent to the application, typically via a pre-made phishing URL. This establishes an OAuth grant that allows the malicious client applocation to access resources on-behalf-of the user.

Read More
Microsoft Entra ID Conditional Access Policy (CAP) Modified

Mar 27, 2025 · Domain: Cloud Data Source: Azure Data Source: Microsoft Entra ID Data Source: Microsoft Entra ID Audit Logs Use Case: Identity and Access Audit Use Case: Configuration Audit Tactic: Persistence Resources: Investigation Guide ·
Share on:

Identifies a modification to a conditional access policy (CAP) in Microsoft Entra ID. Adversaries may modify existing CAPs to loosen access controls and maintain persistence in the environment with a compromised identity or entity.

Read More