Investigating Entra ID Attacks

Microsoft Entra ID (formerly Azure Active Directory) is a widely adopted cloud-based identity and access management service, facilitating secure access to applications, data, and resources. However, as a critical component of many organizations' infrastructure, Entra ID has become an attractive target for attackers seeking to gain unauthorized access and escalate privileges.

In this module, we will take a closer look at how attackers abuse authentication and permissions to gain access to cloud environments. We will analyze three significant attack vectors that leverage Microsoft's identity platform:

• OAuth & App Hijacking
• Device Code Phishing
• Illicit Consent Grant

By the end of this module you will understand:

• How attackers abuse OAuth flows
• How to identify, scope and investigate attacks in Entra ID audit logs
• The difference between delegated and application permissions and when/how attackers use them

The events in your SIEM can be found in the following timespan: 16 March 2024 - 18 March 2024