Audit Logs: Scope groupings

Sigma #

• Users Added to Global or Device Admin Roles source high: Monitor and alert for users added to device admin roles.T1078, T1078.004
• End User Consent source low: Detects when an end user consents to an applicationT1528
• End User Consent Blocked source medium: Detects when end user consent is blocked due to risk-based consent.T1528

Show 7 more (10 total) on the rules page

Elastic #

• Entra ID Sign-in BloodHound Suite User-Agent Detected source high: Identifies potential enumeration activity using AzureHound, SharpHound, or BloodHound across Microsoft cloud services. These tools are often used by red teamers and adversaries to map users, groups, roles, applications, and access relationships within Microsoft Entra ID (Azure AD) and Microsoft 365.T1069, T1069.003, T1082, T1087, T1087.004, T1201
• Entra ID Actor Token User Impersonation Abuse source medium: Identifies potential abuse of actor tokens in Microsoft Entra ID audit logs. Actor tokens are undocumented backend mechanisms used by Microsoft for service-to-service (S2S) operations, allowing services to perform actions on behalf of users. These tokens appear in logs with the service's display name but the impersonated user's UPN. While some legitimate Microsoft operations use actor tokens, unexpected usage may indicate exploitation of CVE-2025-55241, which allowed unauthorized access to Azure AD Graph API across tenants before being patched by Microsoft.T1078, T1078.004, T1548, T1550, T1550.001
• Entra ID Kali365 Default User-Agent Detected source high: Identifies the default user agent string associated with Kali365 (also referred to as Kali365 Live), a phishing-as-a-service (PhaaS) platform that automates OAuth 2.0 device code phishing and adversary-in-the-middle (AiTM) session capture against Microsoft 365 and Microsoft Entra ID. The Kali365 Electron desktop client identifies itself with the user agent kali365-live/1.0.0 when polling for and replaying captured OAuth tokens, so its appearance in Entra ID sign-in logs, Entra ID audit logs, or the Microsoft 365 unified audit log indicates that an attacker-controlled Kali365 client is interacting with the tenant using stolen tokens. Unlike dual-use offensive tooling, Kali365 is a criminal service with no legitimate enterprise use, making this user agent a high-fidelity indicator of active account compromise.T1078, T1078.004, T1528, T1550, T1550.001, T1566

Splunk #

• Azure AD PIM Role Assigned source: The following analytic detects the assignment of an Azure AD Privileged Identity Management (PIM) role. It leverages Azure Active Directory events to identify when a user is added as an eligible member to a PIM role. This activity is…T1098, T1098.003
• Azure AD Service Principal New Client Credentials source: The following analytic detects the addition of new credentials to Service Principals and Applications in Azure AD. It leverages Azure AD AuditLogs, specifically monitoring the "Update application*Certificates and secrets management"…T1098, T1098.001

Kusto #

• Application ID URI Changed source medium: Detects changes to an Application ID URI. Monitor these changes to make sure that they were authorized. Ref: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-applications#appid-uri-added-modified-or-removedT1078, T1078.004
• Changes to Application Logout URL source low: Detects changes to an applications sign out URL. Look for any modifications to a sign out URL. Blank entries or entries to non-existent locations would stop a user from terminating a session. Ref: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-applications#logout-url-modified-or-removedT1078, T1078.004
• Conditional Access Policy Modified by New User source medium: Detects a Conditional Access Policy being modified by a user who has not modified a policy in the last 14 days. A threat actor may try to modify policies to weaken the security controls in place. Investigate any change to ensure they are approved. Ref: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-infrastructure#conditional-accessT1078, T1078.004

Show 17 more (36 total) on the rules page

YARA-L #

• Client Secret Added to Entra ID Application source medium: Secrets added to applications have legitimate purposes, but can also be a method of persistence.T1098, T1098.001

Panther #

• Azure Authentication Methods Policy OIDC Discovery URL Changed source high: Detects modifications to the OIDC discovery URL in Azure Entra ID's Authentication Methods Policy. This technique enables attackers to federate the tenant with attacker-controlled identity providers, bypassing multi-factor authentication and enabling unauthorized access through bring-your-own IdP methods.T1556, T1556.009
• Azure Domain Federation Settings Modified source medium: Detects modifications to domain federation settings in Microsoft Entra ID, including changes to federation trust configurations and OIDC discovery endpoints. Adversaries who compromise administrative accounts may modify these settings to federate the tenant with attacker-controlled identity providers, enabling unauthorized access and MFA bypass. This technique allows attackers to establish persistent access by redirecting authentication to malicious infrastructure.T1556, T1556.006
• Azure User Elevated to User Access Administrator Role source high: Detects when a user elevates their permissions to the "User Access Administrator" role in Azure, which grants full control over access management for Azure resources. The User Access Administrator role is one of the most powerful privileged roles in Azure, allowing the holder to manage user access to all Azure resources, assign roles to other users including administrative roles, and effectively control the entire Azure subscription's permission structure.T1098, T1098.003

Show 4 more (7 total) on the rules page