Threat hunts for Entra ID

10 hunts

1. high Part 1 of 2

   Research by Huntress

   Sideloaded AppX OAuth Token Theft

   An adversary has enabled Developer Mode and sideloaded a malicious AppX package to abuse WWAHost.exe, allowing them to capture MFA-compliant OAuth tokens via a legitimate Microsoft login dialog.

   3 query1 analytic1 checkpoint1 action2 task

   credential access · defense evasion · execution
2. high Part 2 of 2

   Research by Huntress

   Knight Office Token Theft and Device Persistence

   An adversary has stolen Microsoft 365 session tokens via a device-code phishing flow and secured persistence by enrolling an unauthorized rogue device into the Entra ID tenant.

   3 query1 analytic1 checkpoint1 action3 task

   credential access · initial access · persistence
3. high Part 1 of 2

   Research by Huntress

   Knight Office Phishing Delivery and Redirects

   An adversary is using Monday.com redirects and .vu landing pages to deliver Knight Office phishing lures to M365 users.

   3 query1 analytic1 checkpoint1 action2 task

   credential access · initial access · persistence
4. high

   Research by Red Canary

   Entra ID Agent User Impersonation and Teams Abuse

   An attacker uses the Entra ID Agent User OAuth flow to impersonate an AI agent and dispatch malicious content via Microsoft Teams using Graph API cmdlets.

   3 query1 analytic1 checkpoint1 action2 task

   execution · initial access
5. high

   Research by Elastic Security Labs

   Bulk Directory Discovery via AAD Graph API

   An adversary uses legacy Azure AD Graph API endpoints and known offensive Client IDs to perform bulk directory enumeration, specifically targeting internal API versions that expose sensitive authentication methods.

   3 query2 analytic2 checkpoint1 action2 task

   discovery · execution · initial access
6. high

   Research by Elastic Security Labs

   Obfuscated Identity and Host Access

   An adversary is using multi-hop proxies or tunnels to mask their origin during authentication to cloud identity providers, subsequently using that access to reach internal hosts and execute local commands.

   5 query2 analytic1 checkpoint1 action2 task

   command and control · execution · initial access
7. high Part 2 of 2

   Research by Unit 42

   Spring Ring: NTLM Relay and RAT C2

   An attacker has deployed a custom Python environment to facilitate NTLM relay attacks and a PowerShell-based RAT that beacons to external command-and-control infrastructure.

   3 query1 analytic1 checkpoint1 action2 task

   command and control · defense evasion · discovery
8. high Part 1 of 2

   Research by Unit 42

   Microsoft Teams Vishing and Malicious Payload Execution

   An adversary is using external Microsoft Teams accounts to masquerade as IT support and coerce employees into executing RMM tools or custom payloads that perform discovery and persistence.

   5 query2 analytic1 checkpoint1 action2 task

   command and control · defense evasion · discovery
9. medium

   Research by Elastic Security Labs

   Suspicious ingress tool transfer via native utilities

   An adversary is using native Linux or macOS utilities like curl or wget to download malicious payloads from external infrastructure, hiding their activity within the high volume of legitimate cloud automation.

   3 query1 analytic1 checkpoint1 action2 task

   command and control
10. high

    Research by Red Canary

    Entra ID Assistive Agent Impersonation

    An adversary has gained initial access by tricking a user into consenting to an assistive agent blueprint, then used an on-behalf-of flow to execute malicious Graph API actions from a macOS-based PowerShell environment.

    5 query2 analytic1 checkpoint1 action2 task

    credential access · execution · exfiltration