CVE-2026-65801: Critical Microsoft Cloud CVEs (Exchange Online SSRF, Entra ID Deserialization, Fabric Path Traversal) — Detection and Remediation Guide

---
title: Suspicious OAuth Consent Grant with Broad Scope in Entra ID
id: 3c1a8f92-7b4e-4d21-9c58-6f2e1a0b8d44
status: experimental
description: Detects admin consent grants to applications with high-impact scopes (mail, directory write) consistent with post-exploitation persistence after Entra ID or Exchange Online compromise (CVE-2026-69836, CVE-2026-65801).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-69836
  - https://attack.mitre.org/techniques/T1550/001/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.credential_access
  - attack.t1550.001
logsource:
  product: azure
  service: auditlogs
detection:
  selection_operation:
    OperationName: 'Consent to application'
  selection_scope:
    TargetResources|contains:
      - 'Mail.Read'
      - 'Mail.ReadWrite'
      - 'Directory.ReadWrite.All'
      - 'full_access_as_app'
      - 'RoleManagement.ReadWrite.Directory'
  condition: selection_operation and selection_scope
falsepositives:
  - Legitimate enterprise application onboarding — validate against change management records
level: high
---
title: Service Principal Credential Addition Outside Change Window
id: 8f2d6c41-3a9b-4e77-b215-0d4c9e7a1f66
status: experimental
description: Detects addition of credentials (secrets or certificates) to service principals or app registrations, a common persistence mechanism following identity-plane exploitation (CVE-2026-69836).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-69836
  - https://attack.mitre.org/techniques/T1098/001/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1098.001
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    OperationName|contains:
      - 'Add service principal credentials'
      - 'Update application - Certificates and secrets'
      - 'Add app role assignment to service principal'
  filter_known_automation:
    InitiatedBy|contains:
      - 'terraform'
      - 'Azure DevOps'
  condition: selection and not filter_known_automation
falsepositives:
  - CI/CD pipelines rotating application secrets — tune the filter to your automation identities
level: high
---
title: Exchange Online Mailbox Permission or Inbox Rule Change Following Anomalous Sign-In
id: 5e7b3d08-1c6f-4a92-8d34-2b8e5c0f9a71
status: experimental
description: Detects mailbox delegation or inbox rule manipulation in Exchange Online, consistent with privilege escalation follow-on activity from SSRF-driven token theft (CVE-2026-65801).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-65801
  - https://attack.mitre.org/techniques/T1098/002/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.collection
  - attack.t1098.002
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    OperationName:
      - 'Add-MailboxPermission'
      - 'Set-Mailbox'
      - 'New-InboxRule'
      - 'Set-InboxRule'
      - 'Add-RecipientPermission'
  condition: selection
falsepositives:
  - Helpdesk mailbox administration — correlate with ticket system and admin PIM activations
level: medium

let WindowStart = ago(7d);
let SuspiciousSignIns =
    union SigninLogs, AADNonInteractiveUserSignInLogs
    | where TimeGenerated >= WindowStart
    | where AppDisplayName has_any ("Exchange", "Office 365", "Microsoft Graph")
       or ResourceDisplayName has_any ("Exchange Online", "Microsoft Graph")
    | where ResultType == 0
    | summarize FirstSeen=min(TimeGenerated), Locations=make_set(Location),
                IPs=make_set(IPAddress), Apps=make_set(AppDisplayName)
        by UserPrincipalName, AADTenantId
    | where array_length(IPs) > 3 or FirstSeen > ago(3d);
SuspiciousSignIns
| join kind=leftouter (
    AuditLogs
    | where TimeGenerated >= WindowStart
    | where OperationName has_any ("Consent to application",
                                   "Add service principal credentials",
                                   "Update application")
    | extend InitiatedByUser = tostring(InitiatedBy.user.userPrincipalName)
    | project PostAuthTime=TimeGenerated, OperationName,
              InitiatedByUser, TargetResources
) on $left.UserPrincipalName == $right.InitiatedByUser
| join kind=leftouter (
    OfficeActivity
    | where TimeGenerated >= WindowStart
    | where Operation in ("Add-MailboxPermission", "New-InboxRule",
                          "Set-InboxRule", "Add-RecipientPermission")
    | project MailOpTime=TimeGenerated, Operation, UserId, Parameters
) on $left.UserPrincipalName == $right.UserId
| project UserPrincipalName, FirstSeen, IPs, Locations,
          OperationName, PostAuthTime, Operation, MailOpTime
| sort by FirstSeen desc

PowerBIActivity
| where TimeGenerated >= ago(7d)
| where OperationName in ("ViewArtifact", "ExportArtifact", "GetWorkspaceArtifact")
| summarize ArtifactCount=dcount(ArtifactId), Workspaces=make_set(WorkspaceId),
            Artifacts=make_set(ArtifactName)
    by UserId, bin(TimeGenerated, 1h)
| where ArtifactCount > 50 or array_length(Workspaces) > 5
| sort by ArtifactCount desc

-- Hunt admin endpoints for suspicious cloud tooling and token cache access
-- Relevant to post-exploitation triage for CVE-2026-65801 / CVE-2026-69836
LET procs = SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(Connect-ExchangeOnline|Connect-MgGraph|Connect-AzureAD|ExchangeOnlineManagement)'
   OR CommandLine =~ '(?i)(-CertificateThumbprint|-ClientSecret|access.token|accesstoken)'

LET tokencache = SELECT FullPath, Size, Mtime
FROM glob(globs='C:\\Users\\*\\AppData\\Local\\.IdentityService\\*')
WHERE Mtime > timestamp(epoch=now() - 604800)

SELECT 'process' AS ArtifactType, Pid, Name, CommandLine, Username,
       CreateTime AS EventTime, '' AS FullPath
FROM procs
UNION ALL
SELECT 'token_cache' AS ArtifactType, NULL AS Pid, '' AS Name,
       '' AS CommandLine, '' AS Username, Mtime AS EventTime, FullPath
FROM tokencache

# CVE-2026-65801 / CVE-2026-69836 tenant audit — run with Global Reader or higher
# Requires: Microsoft.Graph, ExchangeOnlineManagement modules
Connect-MgGraph -Scopes "AuditLog.Read.All","Directory.Read.All","Application.Read.All"
Connect-ExchangeOnline

$start = (Get-Date).AddDays(-14).ToString('yyyy-MM-ddTHH:mm:ssZ')

# 1. Recent consent grants with high-impact scopes
Write-Host "=== OAuth Consent Grants (last 14 days) ===" -ForegroundColor Cyan
Get-MgAuditLogDirectoryAudit -Filter "activityDateTime ge $start" -All |
  Where-Object { $_.ActivityDisplayName -eq 'Consent to application' } |
  ForEach-Object {
    [PSCustomObject]@{
      Time      = $_.ActivityDateTime
      Initiator = $_.InitiatedBy.user.userPrincipalName
      Target    = ($_.TargetResources | Select-Object -First 1).DisplayName
      Scopes    = ($_.TargetResources | Select-Object -First 1).ModifiedProperties
    }
  } | Format-List

# 2. Service principal credential additions
Write-Host "=== Service Principal Credential Changes ===" -ForegroundColor Cyan
Get-MgAuditLogDirectoryAudit -Filter "activityDateTime ge $start" -All |
  Where-Object { $_.ActivityDisplayName -match 'credential|Certificates and secrets' } |
  Select-Object ActivityDateTime, ActivityDisplayName,
    @{n='Initiator';e={$_.InitiatedBy.user.userPrincipalName}} | Format-Table -AutoSize

# 3. New app registrations
Write-Host "=== New App Registrations ===" -ForegroundColor Cyan
Get-MgAuditLogDirectoryAudit -Filter "activityDateTime ge $start" -All |
  Where-Object { $_.ActivityDisplayName -eq 'Add application' } |
  Select-Object ActivityDateTime,
    @{n='Initiator';e={$_.InitiatedBy.user.userPrincipalName}},
    @{n='AppName';e={($_.TargetResources | Select-Object -First 1).DisplayName}} | Format-Table -AutoSize

# 4. Exchange mailbox delegation and inbox rule changes
Write-Host "=== Exchange Mailbox Permission / Inbox Rule Changes ===" -ForegroundColor Cyan
Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-14) -EndDate (Get-Date) `
  -Operations "Add-MailboxPermission","New-InboxRule","Set-InboxRule","Add-RecipientPermission" `
  -ResultSize 5000 |
  Select-Object CreationDate, UserIds, Operations, AuditData | Format-List

# 5. Verify CA policies block legacy auth (SSRF token replay often pivots to legacy protocols)
Write-Host "=== Conditional Access Policies ===" -ForegroundColor Cyan
Get-MgIdentityConditionalAccessPolicy |
  Select-Object DisplayName, State | Format-Table -AutoSize

Write-Host "Review output against change tickets. Any unaccounted consent grant, credential addition, or mailbox delegation is a potential indicator of compromise." -ForegroundColor Yellow