Data Source: Microsoft Graph Activity Logs

Suspicious Email Access by First-Party Application via Microsoft Graph

May 10, 2025 · Domain: Cloud Data Source: Azure Data Source: Microsoft Graph Data Source: Microsoft Graph Activity Logs Use Case: Threat Detection Tactic: Collection Resources: Investigation Guide ·

Share on:

Identifies access to email resources via Microsoft Graph API using an first-party application on behalf of a user principal. This behavior may indicate an adversary using a phished OAuth refresh token or a Primary Refresh Token (PRT) to access email resources. The pattern includes requests to Microsoft Graph API endpoints related to email, such as /me/mailFolders/inbox/messages or /users/{user_id}/messages, using a public client application ID and a user principal object ID. This is a New Terms rule that only signals if the application ID and user principal object ID have not been seen doing this activity in the last 14 days.

Microsoft Entra ID Session Reuse with Suspicious Graph Access

May 10, 2025 · Domain: Cloud Data Source: Azure Data Source: Microsoft Entra ID Data Source: Microsoft Entra ID Sign-In Logs Data Source: Microsoft Graph Data Source: Microsoft Graph Activity Logs Use Case: Identity and Access Audit Use Case: Threat Detection Resources: Investigation Guide Tactic: Defense Evasion Tactic: Initial Access ·

Share on:

Identifies potential session hijacking or token replay in Microsoft Entra ID. This rule detects cases where a user signs in and subsequently accesses Microsoft Graph from a different IP address using the same session ID within a short time window. This may indicate the use of a stolen refresh/access token or session cookie to impersonate the user and interact with Microsoft services.

Microsoft Graph First Occurrence of Client Request

May 2, 2025 · Domain: Cloud Data Source: Azure Data Source: Microsoft Graph Data Source: Microsoft Graph Activity Logs Resources: Investigation Guide Use Case: Identity and Access Audit Tactic: Initial Access ·

Share on:

This New Terms rule focuses on the first occurrence of a client application ID (azure.graphactivitylogs.properties.app_id) making a request to Microsoft Graph API for a specific tenant ID (azure.tenant_id) and user principal object ID (azure.graphactivitylogs.properties.user_principal_object_id). This rule may helps identify unauthorized access or actions performed by compromised accounts. Advesaries may succesfully compromise a user's credentials and use the Microsoft Graph API to access resources or perform actions on behalf of the user.