Attack : stolen client secrets to sign into Entra ID as legitimate applications.

A major threat campaign is actively targeting organizations by using stolen client secrets to sign into Entra ID as legitimate applications.

Because this bypasses user passwords and MFA prompts, typical Conditional Access policies may not stop it. Once inside, threat actors are targeting Azure Resource Manager, Key Vault, Graph API, and SharePoint files to harvest more credentials. If you manage a tenant or an MSP application, check your logs immediately. 🔍 What to check right now: 1. Go to Entra ID > Monitoring & health > Sign-in logs > Service principal sign-ins. 2. Search for these known Indicators of Compromise (IoCs): • 199.19.77.84 (High confidence link) • 199.19.77.18 • 65.87.223.26 3. Look for error codes AADSTS7000215 (invalid secret) and AADSTS7000222 (expired secret) coming from unrecognized IP addresses. 4. Microsoft Defender Users: Search Threat Analytics for "Stolen application credentials" to read the full scope. Review your non-interactive sign-ins and look back as far as your data retention allows.

Tip: block geographic regions your user base is unauthorized to connect from. 

In this case, at least for US based businesses you could rule out two of these source IPs without having to check. Another more fine toothed rule would be block tor exit nodes. No legitimate good or legitimate business need for connecting through Tor

Tip2: check AADServicePrincipalSignInLogs for unfamiliar IPs (if you're even shipping that table), list apps where credentials were added recently via the audit log ("Update application – Certificates and secrets management"), and rotate anything that looks off.

Posted in: cyber,Hacking