Azure AD Graph Access with Unusual Client and User
Identifies Azure AD Graph (graph.windows.net) requests where the combination of calling OAuth client ("azure.aadgraphactivitylogs.properties.app_id") and signed-in user ("user.id") has not been observed in the tenant…
Description
Identifies Azure AD Graph (graph.windows.net) requests where the combination of calling OAuth client ("azure.aadgraphactivitylogs.properties.app_id") and signed-in user ("user.id") has not been observed in the tenant in a historical window. A user appearing against AAD Graph under an OAuth client that has not previously authenticated that user is a sign of a FOCI swap, a phished refresh token being redeemed for a new client, or an adversary running tooling under a client identity the user does not normally use.
Detection logic
Its licence does not clear it for publishing here
Sunturai publishes a detection's own text where the licence it arrived under has been reviewed and permits it, and Elastic License 2.0 has not. The query as its source wrote it, its canonical form and the hash that pins this revision are in the workspace record.
Detection requirements
- Platform
- ContainersESXiIaaSIdentity ProviderLinuxmacOSOffice SuiteSaaSWindows
The rule states no platform. This is derived from the 2 ATT&CK techniques it maps to.
- Log source category
- event_index
Known benign triggers
- Authorized red team or audit activity. Add exceptions on the calling user after review.
- First-time use of a legitimate first-party or sanctioned client by the user (newly installed app, first sign-in to a workload, fresh PowerShell module install). Validate by `azure.aadgraphactivitylogs.properties.app_id` and the user's history.
MITRE ATT&CK mappings
0 exclusive techniques.This is coverage no other published rule has; it is not this rule's total technique count.
References
| Reference | Cited by |
|---|---|
| dirkjanm.io/phishing-for-microsoft-entra-primary-refresh-tokens/ | 10 |
| github.com/secureworks/family-of-client-ids-research | 5 |
| learn.microsoft.com/en-us/graph/migrate-azure-ad-graph-overview | 6 |
From the source
- At source
- Open at source
- Upstream identifier
- fd9d2933-f0f9-4aac-810c-a31f6a4a7890
- Tagged by the source as
- Data Source: AzureData Source: Azure AD GraphData Source: Azure AD Graph Activity LogsDomain: CloudDomain: IdentityNoise: MediumPerformance: NormalPlatform: AzurePlatform: Entra IDResources: Investigation GuideRule Type: New TermsTactic: Defense EvasionTactic: DiscoveryUse Case: Threat Detection
Licence
- Published under
- Elastic License 2.0Read the licence
- Attribution
- Required
Authorship
- Written by
- Published
- Sep 20, 2026
- Version
- 3