Entra ID Sign-in BloodHound Suite User-Agent Detected
Identifies potential enumeration activity using AzureHound, SharpHound, or BloodHound across Microsoft cloud services. These tools are often used by red teamers and adversaries to map users, groups, roles,…
Description
Identifies potential enumeration activity using AzureHound, SharpHound, or BloodHound across Microsoft cloud services. These tools are often used by red teamers and adversaries to map users, groups, roles, applications, and access relationships within Microsoft Entra ID (Azure AD) and Microsoft 365.
Detection logic
Its licence does not clear it for publishing here
Sunturai publishes a detection's own text where the licence it arrived under has been reviewed and permits it, and Elastic License 2.0 has not. The query as its source wrote it, its canonical form and the hash that pins this revision are in the workspace record.
Detection requirements
- Platform
- ContainersESXiIaaSIdentity ProviderLinuxmacOSNetwork DevicesOffice SuiteSaaSWindows
The rule states no platform. This is derived from the 7 ATT&CK techniques it maps to.
- Log source category
- event_index
Known benign triggers
- Expected red team assessments or penetration tests may utilize BloodHound tools to evaluate the security posture of Azure or Microsoft 365 environments. If this is expected behavior, consider adjusting the rule or adding exceptions for specific IP addresses, registered applications, JWT tokens, PRTs or user principal names (UPNs).
- Legitimate administrative or security assessment activities may use these user-agents, especially in environments where BloodHound is employed for authorized audits. If this is expected behavior, consider adjusting the rule or adding exceptions for specific user-agents or IP addresses.
MITRE ATT&CK mappings
0 exclusive techniques.This is coverage no other published rule has; it is not this rule's total technique count.
- T1069Permission Groups Discovery39 detections cover this technique
- T1082System Information Discovery134 detections cover this technique
- T1087Account Discovery91 detections cover this technique
- T1201Password Policy Discovery18 detections cover this technique
- T1526Cloud Service Discovery65 detections cover this technique
- T1580Cloud Infrastructure Discovery44 detections cover this technique
- T1673Virtual Machine Discovery4 detections cover this technique
References
| Reference | Cited by |
|---|---|
| github.com/SpecterOps/AzureHound | 3from 2 sources |
| specterops.io/bloodhound-overview/ | Only this detection cites it |
| www.microsoft.com/en-us/security/blog/2025/05/27/new-russia-affiliated-actor-void-blizzard-targets-critical-sectors-for-espionage/ | 7 |
From the source
- At source
- Open at source
- Upstream identifier
- c28750fa-4092-11f0-aca6-f661ea17fbcd
- Tagged by the source as
- Data Source: AzureData Source: Azure Activity LogsData Source: Graph APIData Source: Graph API Activity LogsData Source: Microsoft 365Data Source: Microsoft 365 Audit LogsData Source: Microsoft Entra IDData Source: Microsoft Entra ID Audit LogsData Source: Microsoft Entra ID Sign-in LogsDomain: CloudDomain: IdentityDomain: SaaSNoise: LowPerformance: NormalPlatform: Entra IDPlatform: Microsoft 365Resources: Investigation GuideRule Type: Event Correlation (EQL)Tactic: DiscoveryUse Case: Identity and Access AuditUse Case: Threat Detection
Licence
- Published under
- Elastic License 2.0Read the licence
- Attribution
- Required
Authorship
- Written by
- Published
- Sep 20, 2026
- Version
- 3