Microsoft Entra ID Max-Severity Flaw Exploited in the Wild: Defender's Detection and Remediation Guide

---
title: Entra ID Anomalous Token Use From Suspicious Infrastructure
id: 3f8a2c41-7b9e-4d15-a6c2-8e1f0b3d5a77
status: experimental
description: Detects successful Entra ID sign-ins originating from hosting providers, VPN exits, or anonymizer infrastructure where the authentication used a token without an interactive MFA claim — a pattern consistent with forged or replayed token abuse.
references:
  - https://www.bleepingcomputer.com/news/microsoft/microsoft-warns-of-max-severity-entra-id-flaw-exploited-in-attacks/
  - https://attack.mitre.org/techniques/T1550/001/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.defense_evasion
  - attack.t1550.001
  - attack.initial_access
logsource:
  product: azure
  category: signin
detection:
  selection_anomalous_network:
    network_location_detail|contains:
      - 'hosting'
      - 'vpn'
      - 'tor'
      - 'proxy'
  selection_no_mfa:
    authentication_requirement: 'singleFactorAuthentication'
  condition: selection_anomalous_network and selection_no_mfa
falsepositives:
  - Users on corporate VPN egress points registered as hosting ranges
  - Service accounts with legacy authentication
level: high
---
title: Entra ID Privileged Role or Service Principal Credential Addition
id: 9c1e5b28-4a6d-4f83-b2e7-5d9a0c1f6e33
status: experimental
description: Detects additions of credentials to service principals or assignments of privileged directory roles in Entra ID — common persistence actions after identity-plane compromise.
references:
  - https://attack.mitre.org/techniques/T1098/
  - https://attack.mitre.org/techniques/T1098.001/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.privilege_escalation
  - attack.t1098
logsource:
  product: azure
  category: auditlogs
detection:
  selection:
    operation_name|contains:
      - 'Add service principal credentials'
      - 'Add member to role'
      - 'Add eligible member to role'
      - 'Add app role assignment to service principal'
      - 'Consent to application'
  condition: selection
falsepositives:
  - Legitimate application onboarding and role administration — baseline expected admin activity and alert on deviations
level: high
---
title: OAuth Consent Grant to Newly Registered Application
id: 61d4f7a0-2c8b-4e59-9a31-7f2c6d0e8b44
status: experimental
description: Detects consent grants to applications registered within a short window, a hallmark of illicit consent-grant persistence following identity compromise.
references:
  - https://attack.mitre.org/techniques/T1550.001/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1550
logsource:
  product: azure
  category: auditlogs
detection:
  selection:
    operation_name: 'Consent to application'
    result: 'success'
  condition: selection
falsepositives:
  - Users consenting to legitimate third-party SaaS — restrict via admin consent workflow
level: medium

// Hunt: anomalous token-based sign-ins followed by persistence actions
let lookback = 14d;
let SuspiciousSignins =
    SigninLogs
    | where TimeGenerated > ago(lookback)
    | where ResultType == "0"
    | where AuthenticationRequirement == "singleFactorAuthentication"
    | extend IPClass = tostring(parse_json(NetworkLocationDetails)[0].NetworkNames)
    | where IPClass has_any ("hosting", "vpn", "proxy", "tor")
        or IPAddress !in (dynamic([])) // populate with known corporate egress ranges
    | summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), IPs=make_set(IPAddress), Apps=make_set(AppDisplayName) by UserPrincipalName, CorrelationId;
let PersistenceActions =
    AuditLogs
    | where TimeGenerated > ago(lookback)
    | where OperationName has_any ("Add service principal credentials", "Add member to role", "Consent to application", "Add federated domain")
    | extend Actor = tostring(InitiatedBy.user.userPrincipalName)
    | summarize Actions=make_set(OperationName), ActionTime=min(TimeGenerated) by Actor;
SuspiciousSignins
| join kind=inner (PersistenceActions) on $left.UserPrincipalName == $right.Actor
| project UserPrincipalName, FirstSeen, LastSeen, IPs, Apps, Actions, ActionTime
| order by ActionTime asc;

// Sweep: all credential/consent/role changes in the exposure window, with actor context
AuditLogs
| where TimeGenerated > ago(14d)
| where OperationName has_any ("Add service principal credentials", "Update application", "Add member to role", "Consent to application", "Add owner to application")
| mv-expand TargetResources
| extend Target = tostring(TargetResources.displayName)
| extend ActorUPN = tostring(InitiatedBy.user.userPrincipalName), ActorIP = tostring(InitiatedBy.user.ipAddress)
| project TimeGenerated, OperationName, ActorUPN, ActorIP, Target, Result
| order by TimeGenerated desc;

-- Hunt for non-browser processes accessing token cache / cloud auth endpoints
SELECT Pid, Name, Exe, CommandLine, Username,
       RemoteIP, RemotePort, Status
FROM netstat()
WHERE (RemoteIP =~ '20\.' OR RemoteIP =~ '40\.' OR RemoteIP =~ '52\.' OR RemoteIP =~ '13\.')
  AND RemotePort = 443
  AND NOT Exe =~ '(?i)(msedge|chrome|firefox|iexplore|Teams|OUTLOOK|OneDrive|SearchApp|svchost)\.exe'

-- Hunt for processes opening Primary Refresh Token / WAM token cache artifacts
SELECT Pid, Name, Exe, CommandLine, Username
FROM pslist()
WHERE CommandLine =~ '(?i)(tbres|TokenBroker|Microsoft.AAD.BrokerPlugin|cloudap|PrimaryRefreshToken|roadtx|ROADtools|AADInternals)'

# Entra ID post-patch verification and hardening audit
# Run with Global Reader / Global Admin. Requires Microsoft.Graph module.

Connect-MgGraph -Scopes "Directory.Read.All","Policy.Read.All","AuditLog.Read.All" -NoWelcome

# 1. Review service principal credentials added in the last 30 days (persistence check)
$cutoff = (Get-Date).AddDays(-30)
Get-MgServicePrincipal -All | ForEach-Object {
    $sp = $_
    foreach ($cred in $sp.KeyCredentials) {
        if ($cred.StartDateTime -gt $cutoff) {
            Write-Host "[ALERT] New key credential on SP '$($sp.DisplayName)' ($($sp.AppId)) added $($cred.StartDateTime)"
        }
    }
    foreach ($cred in $sp.PasswordCredentials) {
        if ($cred.StartDateTime -gt $cutoff) {
            Write-Host "[ALERT] New password credential on SP '$($sp.DisplayName)' ($($sp.AppId)) added $($cred.StartDateTime)"
        }
    }
}

# 2. Audit privileged role assignments changed recently
Get-MgDirectoryRole -All | ForEach-Object {
    $role = $_
    Get-MgDirectoryRoleMember -DirectoryRoleId $role.Id -All | ForEach-Object {
        Write-Host "[ROLE] $($role.DisplayName) -> $($_.AdditionalProperties.userPrincipalName)"
    }
}

# 3. Flag OAuth consent grants in the exposure window
Get-MgAuditLogDirectoryAudit -Filter "activityDateTime ge $($cutoff.ToString('yyyy-MM-ddTHH:mm:ssZ'))" -All |
    Where-Object { $_.ActivityDisplayName -match 'Consent to application|Add service principal credentials' } |
    Select-Object ActivityDateTime, ActivityDisplayName,
        @{n='Actor';e={$_.InitiatedBy.user.userPrincipalName}}, Result |
    Format-Table -AutoSize

# 4. Verify legacy authentication is blocked (token flaws + legacy auth = bypass path)
$policies = Get-MgIdentityConditionalAccessPolicy -All
$legacyBlocked = $policies | Where-Object {
    $_.Conditions.ClientAppTypes -contains 'exchangeActiveSync' -or
    $_.Conditions.ClientAppTypes -contains 'other'
}
if (-not $legacyBlocked) {
    Write-Host "[WARN] No Conditional Access policy blocking legacy authentication clients — create one now"
}

# 5. List federated domains for tampering (attackers add federated domains for re-entry)
Get-MgDomain -All | Where-Object { $_.AuthenticationType -eq 'Federated' } |
    Select-Object Id, AuthenticationType, IsVerified

Write-Host "`nAudit complete. Investigate every [ALERT] entry before declaring the tenant clean."