Profile: Beta

Entra ID Federated Identity Credential Modified

Oct 8, 2026 · Domain: Cloud Domain: Identity Data Source: Azure Data Source: Microsoft Entra ID Audit Logs Use Case: Identity and Access Audit Tactic: Persistence Tactic: Privilege Escalation Tactic: Defense Evasion Resources: Investigation Guide Profile: Beta Rule Type: ES|QL Platform: Entra ID ·

Share on:

Detects when a federated identity credential is added to an Entra ID application, or when the issuer or subject of an existing credential is changed. Adversaries with application-management rights can federate the application to an attacker-controlled identity provider, or re-scope an existing trust on a shared issuer such as GitHub Actions to an identity they control, and authenticate as its service principal without creating a client secret.

Entra ID End-User Consent to Application with High-Risk Delegated Scopes

Oct 8, 2026 · Domain: Cloud Domain: Identity Data Source: Azure Data Source: Microsoft Entra ID Data Source: Microsoft Entra ID Audit Logs Platform: Entra ID Profile: Beta Use Case: Identity and Access Audit Threat: OAuth App Consent Resources: Investigation Guide Tactic: Initial Access Tactic: Credential Access Rule Type: ES|QL ·

Share on:

Identifies an end-user (non-admin) consent grant in Microsoft Entra ID to an application requesting delegated scopes commonly abused in illicit consent grant (OAuth phishing) attacks, such as mail, mailbox settings, contacts, files, SharePoint, OneNote, Teams chat and Exchange Web Services. Graph scopes are evaluated together with offline_access, which returns a long-lived refresh token and gives an attacker-controlled application durable, silent access to the victim's data without stealing a password or re-prompting for MFA. The alert classifies the application owner as Microsoft first-party, in-tenant or external to help prioritize review.

GitHub OAuth Application Authorized

Oct 1, 2026 · Domain: Cloud Domain: SaaS Domain: Identity Platform: GitHub Profile: Beta Use Case: Threat Detection Tactic: Credential Access Tactic: Persistence Threat: OAuth App Consent Data Source: Github Data Source: GitHub Audit Logs Rule Type: ESQL Resources: Investigation Guide ·

Share on:

Detects when a user authorizes a GitHub OAuth application. Stolen OAuth grants persist after password changes until revoked and can clone or ZIP private repositories. This is not a GitHub App installation (integration_installation.create).