CVE-2026-96207: Critical Microsoft Cloud CVEs (Partner Center, Bookings, Dataverse) — Detection and Remediation Guide

---
title: Anomalous Service Principal Privilege Grant Following Partner Center Access
id: 3f8c2a14-9b7e-4d51-a6c2-8e1f5d9b0a33
status: experimental
description: Detects new app role assignments, consent grants, or service principal credential additions in Entra ID audit logs — a hallmark post-exploitation behavior of a Partner Center privilege-escalation compromise (CVE-2026-96207), where an attacker mints persistent access after elevating privileges.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-96207
  - https://attack.mitre.org/techniques/T1098/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.privilege_escalation
  - attack.t1098
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    operationName:
      - 'Add service principal credentials'
      - 'Consent to application'
      - 'Add app role assignment to service principal'
      - 'Add delegated permission grant'
      - 'Add owner to service principal'
  filter_known:
    initiatedBy|contains: '@securityarsenal.example.com'
  condition: selection and not filter_known
falsepositives:
  - Legitimate application onboarding and GDAP relationship updates by partner administrators
  - Automated CI/CD pipelines that register credentials
level: high
---
title: Suspicious Microsoft Bookings Cross-Tenant Object Access
id: 7b1d4e92-3c8a-4f65-b2d9-5a6e8c1f7d44
status: experimental
description: Detects Bookings-related mailbox and calendar access events in the Unified Audit Log originating from unfamiliar IP addresses or external user agents, consistent with exploitation of CVE-2026-94510 (authorization bypass via user-controlled key) where attackers enumerate or transact against booking objects they do not own.
references:
  - https://attack.mitre.org/techniques/T1530/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1530
logsource:
  product: m365
  service: exchange
detection:
  selection:
    Workload: 'Exchange'
    Operation:
      - 'MailboxLogin'
      - 'CalendarBind'
      - 'FolderBind'
      - 'Send'
    ObjectId|contains: 'booking'
  filter_internal:
    ClientIP|startswith:
      - '10.'
      - '192.168.'
  condition: selection and not filter_internal
falsepositives:
  - External customers legitimately interacting with published booking pages
  - Third-party scheduling integrations
level: medium
---
title: Dataverse Plugin or Solution Modification from Unusual Source
id: c5e9a7b1-2d4f-4a83-9e6c-1b3d7f8a2e55
status: experimental
description: Detects creation or modification of Dataverse plugins, SDK message processing steps, custom workflows, or solution imports — post-exploitation persistence and execution mechanisms consistent with CVE-2026-88131 deserialization RCE in Microsoft Dataverse.
references:
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.persistence
  - attack.t1190
logsource:
  product: m365
  service: powerplatform
detection:
  selection_operation:
    Operation|contains:
      - 'PluginTypeCreate'
      - 'PluginTypeUpdate'
      - 'SdkMessageProcessingStepCreate'
      - 'WorkflowCreate'
      - 'WorkflowUpdate'
      - 'SolutionImport'
      - 'SolutionExport'
  condition: selection_operation
falsepositives:
  - Legitimate Power Platform development and ALM deployment pipelines
  - ISV solution updates
level: high

// HUNT 1: Partner Center post-exploitation — new credentials/consent on partner-linked service principals (CVE-2026-96207)
// Look for privilege-minting operations in the last 14 days, especially from IPs or actors
// with no prior history of performing them.
let lookback = 14d;
let baseline = AuditLogs
| where TimeGenerated between (ago(90d) .. ago(lookback))
| where OperationName has_any ("Add service principal credentials", "Consent to application", "Add app role assignment to service principal", "Add delegated permission grant", "Add owner to service principal")
| summarize by tostring(InitiatedBy.user.userPrincipalName), tostring(InitiatedBy.user.ipAddress);
AuditLogs
| where TimeGenerated > ago(lookback)
| where OperationName has_any ("Add service principal credentials", "Consent to application", "Add app role assignment to service principal", "Add delegated permission grant", "Add owner to service principal", "Add application")
| extend Actor = tostring(InitiatedBy.user.userPrincipalName), ActorIp = tostring(InitiatedBy.user.ipAddress)
| extend TargetResource = tostring(TargetResources[0].displayName)
| where not (baseline | where userPrincipalName == Actor and ipAddress == ActorIp | take 1 | isnotempty)  // novel actor+IP pair
| project TimeGenerated, OperationName, Actor, ActorIp, TargetResource, Result, CorrelationId
| order by TimeGenerated desc;

// HUNT 2: Bookings authorization-bypass probing — high-volume calendar/mailbox access on Booking mailboxes (CVE-2026-94510)
// Attackers enumerating user-controlled keys generate abnormally broad object access from single sources.
OfficeActivity
| where TimeGenerated > ago(7d)
| where OfficeWorkload == "Exchange"
| where Operation in ("MailboxLogin", "CalendarBind", "FolderBind", "MessageBind")
| where OfficeObjectId has "booking" or MailboxOwnerUPN has "booking"
| summarize AccessedObjects = dcount(OfficeObjectId), Ops = count(), Operations = make_set(Operation) by ClientIP, UserId, bin(TimeGenerated, 1h)
| where AccessedObjects > 15   // tune: legitimate booking pages aggregate through service IPs; flag breadth anomalies
| order by AccessedObjects desc;

// HUNT 3: Dataverse persistence — plugin/solution/workflow changes outside deployment windows (CVE-2026-88131)
OfficeActivity
| where TimeGenerated > ago(14d)
| where OfficeWorkload =~ "PowerPlatform" or RecordType in ("PowerPlatformAdminActivity", "Dataverse")
| where Operation has_any ("Plugin", "SdkMessageProcessingStep", "SolutionImport", "Workflow")
| extend HourOfDay = datetime_part("hour", TimeGenerated)
| project TimeGenerated, Operation, UserId, ClientIP, OfficeObjectId, ResultStatus, HourOfDay
| order by TimeGenerated desc;

// HUNT 4: First-time-seen geographies/ASNs touching Partner Center sign-ins (supports CVE-2026-96207 triage)
let known_asns = SigninLogs
| where TimeGenerated between (ago(60d) .. ago(7d))
| where AppDisplayName has_any ("Partner Center", "PartnerCenter", "Microsoft Partner")
| summarize by NetworkLocationDetails, IPAddress;
SigninLogs
| where TimeGenerated > ago(7d)
| where AppDisplayName has_any ("Partner Center", "PartnerCenter", "Microsoft Partner")
| extend ASN = tostring(parse_json(NetworkLocationDetails).networkNames)
| where not (known_asns | where IPAddress == SigninLogs.IPAddress | take 1 | isnotempty)
| project TimeGenerated, UserPrincipalName, AppDisplayName, IPAddress, LocationDetails, ResultType, ConditionalAccessStatus
| order by TimeGenerated desc;

-- Hunt for suspicious processes interacting with Microsoft cloud service endpoints,
-- and for non-standard tooling spawning shells on partner admin workstations
LET endpoints = '(partnercenter\.microsoft\.com|api\.partnercenter\.microsoft\.com|graph\.microsoft\.com|dynamics\.com|dynamics\.com/api|api\.businesscentral)'

SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE (
   -- Scripting engines or download cradles referencing partner/dataverse endpoints
   (CommandLine =~ endpoints AND Name =~ '(powershell|pwsh|wscript|cscript|mshta|rundll32|curl|wget)')
   OR
   -- Shells spawned from office/browser processes (post-exploit staging on operator machines)
   (Name =~ '(cmd|powershell|pwsh)' AND Ppid IN (
       SELECT Pid FROM pslist() WHERE Name =~ '(msedge|chrome|firefox|iexplore|OUTLOOK|WINWORD|EXCEL)'))
)
ORDER BY CreateTime DESC

-- Sweep for recently modified PowerShell module caches / auth token artifacts
-- commonly abused after cloud privilege escalation (MSAL token caches, az/cli contexts)
SELECT FullPath, Size, Mtime, Atime
FROM glob(globs=[
   'C:/Users/*/.IdentityService/*.bin',
   'C:/Users/*/AppData/Local/.IdentityService/*',
   'C:/Users/*/.Azure/*',
   'C:/Users/*/.PartnerCenter*/**',
   'C:/Users/*/AppData/Local/Microsoft/Office/16.0/Licensing/*'
])
WHERE Mtime > now() - 1209600   -- modified in last 14 days
ORDER BY Mtime DESC

# Security Arsenal — CVE-2026-96207 / CVE-2026-94510 / CVE-2026-88131 Triage & Hardening
# Run as a Global Reader / Security Admin. Requires: ExchangeOnlineManagement, Microsoft.Graph

Import-Module ExchangeOnlineManagement, Microsoft.Graph.Authentication, Microsoft.Graph.Identity.DirectoryManagement -ErrorAction Stop
Connect-ExchangeOnline -ShowBanner:$false
Connect-MgGraph -Scopes "AuditLog.Read.All","Directory.Read.All","Application.Read.All" -NoWelcome

# --- 1. Verify Unified Audit Log is enabled (detections depend on it) ---
$auditConfig = Get-AdminAuditLogConfig
Write-Host "[+] UnifiedAuditLogIngestionEnabled: $($auditConfig.UnifiedAuditLogIngestionEnabled)"
if (-not $auditConfig.UnifiedAuditLogIngestionEnabled) {
    Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true
    Write-Warning "Unified Audit Log was DISABLED — re-enabled. You had zero visibility during the exposure window."
}

# --- 2. Hunt: privileged grants & credentials added to service principals in last 14 days ---
$since = (Get-Date).AddDays(-14).ToString("yyyy-MM-dd")
$grants = Get-MgAuditLogDirectoryAudit -Filter "activityDateTime ge $since" -All |
    Where-Object { $_.ActivityDisplayName -match 'Add service principal credentials|Consent to application|Add app role assignment|Add delegated permission grant|Add owner to service principal' }
$grants | Select-Object ActivityDateTime, ActivityDisplayName,
    @{n='Actor';e={$_.InitiatedBy.User.UserPrincipalName}},
    @{n='ActorIp';e={$_.InitiatedBy.User.IpAddress}},
    @{n='Target';e={$_.TargetResources[0].DisplayName}}, Result |
    Export-Csv -Path ".\SvcPrincipal_Grants_$($since).csv" -NoTypeInformation
Write-Host "[+] $($grants.Count) privilege-minting events found — review .\SvcPrincipal_Grants_$($since).csv for anything you cannot attribute to change control."

# --- 3. Inventory high-privilege app role assignments (Partner Center blast radius) ---
$dangerousRoles = @('Directory.ReadWrite.All','RoleManagement.ReadWrite.Directory','Application.ReadWrite.All','AppRoleAssignment.ReadWrite.All','Mail.ReadWrite','full_access_as_app')
$sps = Get-MgServicePrincipal -All -Property "AppRoleAssignments,DisplayName,Id"
$risky = foreach ($sp in $sps) {
    foreach ($ara in $sp.AppRoleAssignments) {
        $risky += [pscustomobject]@{ ServicePrincipal=$sp.DisplayName; SPId=$sp.Id; ResourceId=$ara.ResourceId; AppRoleId=$ara.AppRoleId; Created=$ara.CreatedDateTime }
    }
}
$risky | Export-Csv -Path ".\AppRole_Inventory.csv" -NoTypeInformation
Write-Host "[+] Exported $($risky.Count) app role assignments. Cross-reference AppRoleIds against MSGraph dangerous-role GUIDs and validate every grant against business need."

# --- 4. Enforce: require admin approval for user consent (limits consent-phish follow-on) ---
$consentPolicy = Get-MgPolicyAuthorizationPolicy
if ($consentPolicy.DefaultUserRolePermissions.PermissionGrantPoliciesAssigned -notcontains 'ManagePermissionGrantsForSelf.microsoft-user-default-low') {
    Write-Warning "User consent is not restricted to low-risk permissions. Recommend blocking user consent entirely or enabling the admin consent workflow: Entra ID > Enterprise applications > Consent and permissions."
}

# --- 5. Bookings hygiene: enumerate Bookings-enabled mailboxes for access review ---
$bookingsMailboxes = Get-Mailbox -RecipientTypeDetails SchedulingMailbox -ResultSize Unlimited
Write-Host "[+] $($bookingsMailboxes.Count) Bookings/scheduling mailboxes found. Review their calendar access (Get-MailboxFolderPermission) for external or anonymous sharing."
$bookingsMailboxes | ForEach-Object {
    Get-MailboxFolderPermission -Identity "$($_.Alias):\Calendar" -ErrorAction SilentlyContinue |
        Where-Object { $_.User.DisplayName -match 'Anonymous|Default' -and $_.AccessRights -notmatch 'None|AvailabilityOnly' }
} | Export-Csv -Path ".\Bookings_Calendar_Exposure.csv" -NoTypeInformation
Write-Host "[+] Calendar exposure review exported to .\Bookings_Calendar_Exposure.csv"

Disconnect-ExchangeOnline -Confirm:$false -ErrorAction SilentlyContinue