4 posts tagged with "detections"

A detection release for password-spray account takeover in Microsoft 365, published October 23, 2026. A new high-severity behavior rule, EntraID_SignIn_After_Block, alerts when an attacker who holds a user's password gets into the account after Conditional Access blocked their earlier attempts. It catches the Azure CLI password spraying that Huntress has reported since June 2026, when a risk policy stops the sprayer once and they come back from another address. A precision fix to EntraID_Valid_Password_Blocked ships with it.

No action is needed: the rules sync to every instance automatically.

A detection release for Microsoft Entra ID, published October 23, 2026. Four new behavior rules alert when an app (a service principal acting with no user signed in) assigns directory roles or adds credentials to other apps. An attacker does exactly this with a stolen app certificate or secret, as in the Storm-0940 compromise of ConnectWise's multi-tenant apps that Microsoft reported on October 21. Until now, role assignments and credential changes made by an app were only context, or one step of the EntraID_App_Takeover correlation.

No action is needed: the rules sync to every instance automatically. These notes also correct how the October 18–20 notes described EntraID_DeviceCode_UserApp.

A detection release for the help desk impersonation campaign that Microsoft Threat Intelligence reported on September 2, 2026, published October 23, 2026. The attacker poses as IT support or a colleague in a Teams chat, calls seconds later, and walks the user into a remote-support session or an installer. Two new high-confidence behavior rules cover the first two steps. O365_Teams_OnMicrosoft_Tenant_Chat alerts on the chat, when it comes from a throwaway *.onmicrosoft.com tenant. O365_Endpoint_Download_From_Azure_CloudApp alerts when a browser downloads an installer from the kind of throwaway Azure host these crews use to deliver it.

No action is needed: the rules sync to every instance automatically.

A detection release for Microsoft Entra ID and Microsoft 365, rolled out October 18–20, 2026. It adds 19 alerting behavior rules and 12 context rules covering three campaigns reported by Microsoft Threat Intelligence (Storm-2755's adversary-in-the-middle (AiTM) session theft, Storm-2372's device-code phishing, and Storm-3119's takeover of whole tenants through a registered app) plus detections for persistence, privilege and sign-in abuse. Five older rules are retired or removed.

No action is needed: the rules sync to every instance automatically.